Cisco Talos has disclosed a spear-phishing campaign by the threat group UAT-11985 that targets people connected to Taiwan research organizations, using fake event invitations to steal Google credentials and multi-factor authentication codes. The campaign, first seen in mid-2026, likely relies on AI-assisted content generation to produce tailored lures quickly within a common social engineering framework.

The emails borrow legitimate public event themes and impersonate reputable academic and policy institutions, including the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute. Despite covering varied geopolitical topics, the messages share nearly identical structure: an elaborate context-setting opening, flattering recipient-specific content, and event logistics with registration instructions. Talos researcher Joey Chen said the operation also used QR code phishing by altering legitimate event posters with malicious codes, extending the attack beyond email recipients to people who encounter printed materials.

Links in the emails point to attacker-controlled infrastructure while displaying legitimate-looking Google Forms URLs on hover. The fake registration site imitates a Google Form and serves a pop-up prompting sign-in, leading to a spoofed Google login panel. That panel is an adversary-in-the-middle proxy that uses obfuscated JavaScript to capture entered data in real time over a WebSocket connection while forwarding it to Google's authentication servers. The spoofed panels support only Simplified Chinese, Traditional Chinese, and English locales, suggesting Chinese-speaking targets. Talos said the reused narrative structure, flattery, impersonation, and deceptive registration point to a coordinated, targeted campaign rather than independent invitations.

Source: The Hackers News