UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing

Cybersecurity analysts have uncovered a sophisticated spear-phishing campaign targeting Taiwanese research institutions, utilizing fake event invitations to steal credentials. Referred to as UAT-11985 by Cisco Talos, the attack is believed to utilize AI-generated content to create personalized lures for various targets. The campaign, first spotted mid-2026, employs legitimate event themes and impersonates reputable academic and policy institutions to build credibility.

In addition to traditional email phishing, the attackers incorporate QR code phishing (quishing) techniques by altering genuine event posters with malicious QR codes, expanding the attack to secondary victims. The emails follow a three-part structure: impersonation of legitimate Taiwan-based entities, nearly identical syntactic structures, personalized flattery, institutional impersonation, and a deceptive registration mechanism.

Some phishing emails incorporate legitimate event posters scrapped from legitimate websites, but with altered QR codes to trick victims into scanning the malicious one. The phishing site mimics a legitimate Google Form, but its primary goal is to prompt users to sign in with their Google account, capturing their credentials and MFA codes in real-time through an adversary-in-the-middle (AitM) proxy.

The attack targets Chinese-speaking users by restricting the spoofed Google login panels to Simplified Chinese, Traditional Chinese, and English locales.