The invitations looked like the real thing: genuine upcoming events from respected Taiwanese institutions, flattering notes about the recipient's expertise, and even a reserved VIP seat. Cisco Talos says they were the opening move of a spear-phishing campaign against people affiliated with Taiwan research organizations, built to steal Google accounts in real time.
Talos researcher Joey Chen attributes the activity to an advanced persistent threat cluster it tracks as UAT-11985, and observed it in mid-2026.
Three invitations, one template
The emails impersonated events from the Taiwan European Union Centre, the NCCU Institute of International Relations and the Taiwan Research Institute. One recipient checked with those organizations, and none could confirm that the senders worked for them. The event details themselves appear to have been copied from public announcements, which Talos describes as legitimacy laundering.
All three emails shared the same three-part structure: an inflated passage on geopolitics, a block of interchangeable praise for the recipient, then logistics and a registration link. Talos says the matching syntax across different topics suggests a reusable prompt template, and that the campaign shows strong evidence of AI-assisted writing, while noting it cannot prove the emails were fully generated by a large language model. The visible link showed a Google Forms address, but the real destination was an actor-controlled phishing page.
The actor also attached event posters scraped from legitimate websites with the QR code swapped for a malicious one. Talos reads this as an attempt to reach people beyond the inbox, should a recipient print the poster and pin it on an office notice board.
A live relay that beats MFA
The phishing page mimics a Google Form, then forces a redirect to a convincing Google sign-in page. Behind it is an adversary-in-the-middle kit: the attacker's server passes whatever the victim types to Google in real time and uses a WebSocket connection to tell the fake page which screen to show next, whether a password box, a passkey prompt or a specific MFA challenge. The result, Talos says, is full account takeover without the victim noticing. It is the same broad approach that let a phishing service switch off security keys last month.
The fake login supports only Simplified Chinese, Traditional Chinese and English. Talos assesses with moderate confidence that the interface was first written in Simplified Chinese and later adapted, citing the kit's code structure and mainland-style vocabulary, which suggests a developer whose working language is Simplified Chinese. That is a statement about the tool's author, not a formal attribution to any state.
Verify invitations and prefer phishing-resistant sign-in
Anyone in Taiwan's academic and policy community should treat unsolicited event invitations with care, switch accounts to phishing-resistant sign-in where possible, check the destination of registration links before clicking, and confirm invitations with the host organization through a known contact. Organizations can ask staff to report unexpected posters with QR codes. Talos has released ClamAV signature Html.Phishing.UAT11985-10060614-0 and Snort rules 1:67198 and 7:31, with indicators in its GitHub repository.
The emails were tailored, the events were real and the login page mirrored Google step by step. What this campaign shows is how cheaply that level of polish can now be produced, and why phishing-resistant sign-in, such as security keys or passkeys bound to the real site, is worth more than a sharp eye.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.