A sophisticated phishing campaign tracked as UAT-11985 is using fake academic event invitations, malicious QR codes and realistic Google login pages to steal credentials and authenticated sessions from people linked to Taiwan research organizations.
Cisco Talos first observed the campaign in mid-2026 and found that the attackers impersonated legitimate Taiwanese academic and policy institutions while reusing real public event information to make the invitations appear credible.
The phishing infrastructure operates as an adversary-in-the-middle, or AitM, framework that relays authentication activity between the victim and Google’s legitimate sign-in infrastructure in real time.
This allows the attacker to capture passwords, follow MFA challenges and potentially obtain an authenticated session after the victim completes the real Google login process.
For broader coverage of advanced threat activity and state-linked cyber operations, see our Nation-State Cyber Warfare and APT Threats 2026 Hub.
Key Takeaway
UAT-11985 combines highly personalized event invitations with a real-time Google phishing kit designed to closely mirror the victim’s legitimate authentication experience.
The campaign uses both traditional phishing links and malicious QR codes inserted into legitimate-looking event posters.
Cisco Talos says the invitation language shows strong signs of AI-assisted content generation, allowing the attacker to rapidly customize lures for different researchers, institutions and geopolitical topics.
However, Talos has not conclusively proven that the emails were entirely generated by a large language model.
UAT-11985 Targets Taiwan Research Organizations
Cisco Talos observed the campaign targeting individuals affiliated with Taiwan-based research organizations.
The attacker impersonated legitimate institutions including:
- Taiwan European Union Centre
- NCCU Institute of International Relations
- Taiwan Research Institute
Researchers contacted the organizations associated with the invitations and found that the alleged senders could not be confirmed as legitimate employees or representatives.
This indicates that the threat actor fabricated sender identities while borrowing real institutional names and public event information.
Fake Event Invitations Are Designed to Look Legitimate
The phishing messages are not generic spam.
Talos found that they typically follow a consistent three-part structure.
The first section provides an elaborate geopolitical or policy-focused introduction.
The second section is personalized to the recipient and often praises their expertise or professional background.
The final section provides event logistics such as the topic, date, venue and registration instructions.
This structure gives the messages the appearance of genuine academic or policy invitations.
AI May Be Helping Attackers Personalize the Lures
Cisco Talos found highly similar sentence structures, rhetorical patterns and personalization techniques across multiple invitations.
The messages also contain fluent but formulaic language, repeated sentence patterns and exaggerated professional praise.
Talos says these characteristics strongly suggest that the attacker likely used AI-assisted content generation or reusable prompts to customize phishing emails at scale.
That assessment remains probabilistic rather than definitive.
Visible Google Forms Links Hide Malicious Destinations
One of the campaign’s deception techniques involves displaying what appears to be a legitimate Google Forms registration URL.
However, the underlying hyperlink sends the victim to attacker-controlled infrastructure instead.
This difference between the visible text and the actual destination can fool users who recognize Google Forms as a familiar and trusted service.
Attackers Replace QR Codes on Legitimate Event Posters
UAT-11985 does not rely only on email hyperlinks.
Talos observed the attacker downloading legitimate event posters and replacing the original QR codes with malicious ones.
The modified posters were then distributed as part of the phishing campaign.
This expands the attack beyond email recipients because a printed or forwarded poster could expose additional victims who scan the malicious QR code.
Fake Google Forms Page Leads to a Fake Login
After clicking the malicious link or scanning the QR code, the victim is shown a page designed to resemble a legitimate Google Form.
The page then prompts the user to sign in with a Google account before completing the registration.
The login interface is a spoofed Google authentication page controlled by the attacker.
Its visual design closely imitates Google’s real sign-in experience.
UAT-11985 Uses Real-Time Google AitM Phishing
The phishing kit operates as an adversary-in-the-middle framework.
Rather than simply recording a password, the attacker’s server relays authentication information between the victim and Google’s legitimate login services.
This allows the fake interface to react dynamically to Google’s authentication responses.
If Google asks for a password, passkey prompt, MFA challenge or another authentication step, the attacker can display the corresponding screen to the victim.
This Is Not a Cryptographic MFA Break
The phrase “MFA bypass” can be misleading if interpreted as attackers breaking Google’s authentication algorithms.
That is not what Cisco Talos documented.
The victim completes the legitimate authentication challenge while the attacker sits between the browser and Google’s servers.
Once authentication succeeds, the attacker’s infrastructure can capture information associated with the authenticated session.
The attack abuses the phishing and session-relay process rather than exploiting a flaw in Google’s MFA cryptography.
HTTP POST Requests Handle Data Exfiltration
Talos found that the phishing framework uses HTTP POST requests for event-driven data transmission.
The page can send:
- Browser and device information
- Account identifiers
- Passwords
- Authentication challenge responses
- Session-state information
The attacker uses separate requests for different stages of the authentication process.
WebSockets Keep the Fake Login Synchronized
At the same time, the phishing page establishes a persistent WebSocket connection with the attacker’s infrastructure.
This low-latency channel lets the command-and-control server update the fake Google login screen in real time.
The framework can therefore mirror the legitimate authentication flow as it changes.
The Kit Fingerprints the Victim’s Device
Before authentication begins, the malicious JavaScript collects information about the victim’s browser and device.
Talos observed collection of:
- Browser locale
- User-agent string
- Screen dimensions
- Mobile-device status
This information is sent to the attacker’s infrastructure when the phishing session begins.
Three Languages Are Supported
The spoofed Google login interface supports:
- Simplified Chinese
- Traditional Chinese
- English
The appropriate language is selected based on the victim’s browser configuration.
Talos Assesses the Kit Was Likely Developed in Simplified Chinese
Cisco Talos assessed with moderate confidence that the phishing kit’s user interface was originally developed by someone whose primary working language was Simplified Chinese.
The base localization object was written in Simplified Chinese, while Traditional Chinese and English versions were derived from it.
This is a linguistic assessment and should not be treated as proof that a specific government or organization operates UAT-11985.
UAT-11985 Has Not Been Publicly Attributed to a Named State Actor
Cisco Talos tracks the activity as UAT-11985 and describes the operation as an advanced persistent threat campaign.
However, the research does not publicly attribute the group to a specific named nation-state organization.
The targeting and language indicators provide investigative context, but they are not sufficient on their own to prove government sponsorship.
Why Event Invitations Work as Phishing Lures
Academic conferences, policy discussions and geopolitical events can make effective spear-phishing themes because researchers and analysts regularly receive invitations from organizations they may not have previously contacted.
A convincing lure may combine:
- A recognizable institution
- A relevant policy topic
- A legitimate event title
- A familiar registration service
- Personalized professional praise
Each element helps reduce suspicion.
QR Code Phishing Expands the Attack Beyond Email
QR codes can make traditional security inspection more difficult because the malicious URL is encoded inside an image.
If the recipient scans the code using a phone, the authentication attempt may move from a protected corporate workstation to a mobile browser where the organization has less visibility.
Printed posters can also extend the attack beyond the original email chain.
How This Compares With Other MFA Phishing Attacks
CyberUpdates365 previously examined modern adversary-in-the-middle phishing kits that relay legitimate MFA challenges and capture authenticated sessions.
The same broad principle appears in UAT-11985’s Google-focused campaign: the attacker does not need to break MFA mathematically if the victim can be convinced to complete the legitimate challenge through attacker-controlled infrastructure.
The campaigns and phishing kits are separate, but the defensive lesson is similar.
Phishing-Resistant Authentication Is More Effective
Organizations handling sensitive research, government or policy information should prioritize phishing-resistant authentication methods.
Passkeys and FIDO2/WebAuthn security keys bind authentication to the legitimate website origin.
This provides stronger protection against reverse-proxy and AitM phishing pages because the authentication credential is not normally released to an attacker-controlled domain.
Users Should Inspect the Real Destination of Registration Links
A visible Google Forms address does not guarantee that the underlying hyperlink actually goes to Google.
Before entering credentials, users should verify:
- The browser address bar
- The actual hostname
- Unexpected redirects
- Whether the event exists on the organization’s official website
- Whether the sender can be confirmed through a separate communication channel
Verify Event Invitations Outside the Email Thread
Researchers and policy professionals should independently confirm unexpected invitations.
Instead of replying to the sender or using contact information included in the message, visit the institution’s official website or contact a known representative.
Treat Modified Event Posters as Potential Phishing Vectors
Organizations should not assume that posters are safe simply because their design matches a real event.
A threat actor can copy a legitimate image and change only the QR code.
Staff should verify QR-code destinations before scanning or distributing event posters internally.
Security Teams Should Monitor Suspicious Google Authentication Events
Organizations using Google Workspace should investigate unusual authentication behavior following interaction with external event invitations.
Potential warning signs include:
- Unexpected logins from unfamiliar networks
- New sessions appearing shortly after a user follows an external registration link
- Authentication attempts from unexpected geographic locations
- Unrecognized browser or device sessions
- Suspicious session activity after MFA approval
Cisco Released Detection Coverage
Cisco Talos published detection coverage for the UAT-11985 phishing infrastructure.
Talos lists the following ClamAV signature:
Html.Phishing.UAT11985-10060614-0It also lists Snort detection rules:
Snort 2: 1:67198
Snort 3: 7:31Organizations using those technologies should ensure threat signatures are current.
What Security Teams Should Do Now
- Warn high-risk researchers and policy staff about fake event invitations
- Verify unexpected invitations with the named institution independently
- Inspect the actual destination behind visible Google Forms links
- Scan QR codes before allowing posters to be distributed internally
- Deploy phishing-resistant MFA such as passkeys or FIDO2 security keys
- Review recent Google account sessions after suspicious authentication events
- Revoke suspicious or unauthorized sessions
- Reset credentials when account compromise is suspected
- Monitor new device and browser sign-ins
- Keep email, DNS and network security detections updated
Frequently Asked Questions
What is UAT-11985?
UAT-11985 is the tracking name Cisco Talos uses for an advanced spear-phishing campaign targeting individuals affiliated with Taiwan research organizations.
What does UAT-11985 use as a phishing lure?
The campaign uses fake academic and policy event invitations based on legitimate or plausible public events.
Does UAT-11985 use QR code phishing?
Yes. Cisco Talos observed legitimate event posters modified so their original QR codes were replaced with malicious registration links.
Can the phishing kit bypass Google MFA?
The kit can relay legitimate Google authentication challenges through an adversary-in-the-middle framework and potentially capture an authenticated session after the victim completes MFA. It does not break Google’s MFA cryptography.
Was AI used to generate the phishing emails?
Cisco Talos says the consistent structure and language strongly suggest AI-assisted content generation, but researchers did not conclusively prove that the messages were entirely generated by an LLM.
Is UAT-11985 linked to China?
Talos found linguistic indicators suggesting the phishing kit was likely developed by a native Simplified Chinese speaker, but the campaign has not been publicly attributed to a specific Chinese government group.
Who is being targeted?
The observed campaign focuses on individuals affiliated with Taiwan-based research organizations.
How can users protect themselves?
Users should independently verify event invitations, check actual link destinations, avoid authenticating through suspicious registration pages and use phishing-resistant authentication such as passkeys or FIDO2 security keys where available.
Final Takeaway
UAT-11985 demonstrates how advanced phishing operations can combine targeted social engineering, likely AI-assisted personalization, QR-code phishing and real-time authentication relays.
By borrowing legitimate event information and institutional branding, the campaign creates invitations that appear credible to researchers and policy professionals.
The AitM phishing framework then mirrors Google’s authentication workflow in real time, allowing the attacker to capture credentials and potentially authenticated sessions even when conventional MFA is enabled.
Organizations working with sensitive research and policy information should move toward phishing-resistant authentication, verify unexpected event invitations independently and treat QR codes as potentially hostile links rather than inherently trusted registration tools.
