A recent investigation by cybersecurity experts has uncovered a sophisticated phishing campaign targeting individuals linked to Taiwanese research organizations. This operation, tracked by Cisco Talos as UAT-11985, cleverly uses fake event invitations to lure victims into an adversary-in-the-middle phishing scheme, designed to capture Google account credentials and multi-factor authentication codes. The attack was first detected in mid-2026 and is believed to be enhanced by AI-generated content, allowing rapid adaptation to diverse targets within a unified social engineering strategy.
The attackers employ legitimate public event themes and impersonate well-known academic and policy institutions to gain victims' trust. These phishing emails often include URLs that appear to be Google Forms but redirect users to attacker-controlled sites. The emails display a consistent structure, likely generated from a common template, indicating a mass production approach rather than individual crafting for each recipient.
Furthermore, the threat actors have been impersonating credible Taiwan-based institutions such as the Taiwan European Union Centre and NCCU Institute of International Relations to make their communications more convincing. In some instances, they have altered legitimate event posters to include malicious QR codes, broadening the scope of potential victims beyond just email recipients.
The phishing sites are designed to mimic Google Forms, but their primary function is to trick users into entering their Google credentials, which are then intercepted and relayed in real-time using obfuscated JavaScript via a WebSocket connection. This technique allows attackers to capture sensitive information without alerting the victims. The spoofed login pages are available in Simplified Chinese, Traditional Chinese, and English, suggesting a focus on Chinese-speaking users.
By intercepting credentials and authentication codes in real-time, the attackers can achieve complete account takeover. The use of advanced techniques such as WebSocket connections and region-based language detection demonstrates the sophistication and precision of this phishing campaign.
