Executive Summary
Cisco Talos has identified a sophisticated spear-phishing campaign by a threat actor designated as UAT-11985, targeting individuals affiliated with research and policy institutions in Taiwan. The campaign, which began in mid-2026, utilizes AI-assisted content generation to mass-produce highly convincing event invitations that impersonate reputable organizations like the Taiwan European Union Centre and the Taiwan Research Institute.
Technically, the actor employs an Adversary-in-the-Middle (AitM) framework to bypass Multi-Factor Authentication (MFA). By hosting pixel-perfect replicas of Google login panels, the attackers use a combination of standard HTTP POST requests for initial data and WebSocket connections for real-time relay of credentials and MFA challenges. The campaign also innovates through 'quishing' (QR code phishing), modifying legitimate event posters to redirect users to malicious infrastructure.
The operation is particularly effective due to its real-time reflection of legitimate authentication states, allowing for full account takeover. The focus on Chinese-speaking users and Taiwanese research affiliates indicates a targeted effort to gain access to sensitive academic or geopolitical information.