Cisco Talos has detailed a spear-phishing campaign it tracks as UAT-11985, aimed at people affiliated with Taiwan research organizations. First seen in mid-2026, the emails are invitations to real public events on geopolitical and policy topics, sent from spoofed addresses that impersonate Taiwan institutions such as the Taiwan European Union Centre, NCCU Institute of International Relations and Taiwan Research Institute. Talos says the near-identical structure of the messages suggests they were generated from a reusable AI prompt template: an elaborate description of the topic, flattery aimed at the recipient, then registration details.
The link in each email is disguised, so hovering over it shows what looks like a Google Forms address while the click goes to attacker infrastructure. In some cases the attackers also took genuine event posters and swapped in a malicious QR code, a technique known as quishing, which means people who only see a printed or shared poster can be targeted too. The fake form pops up a prompt to “sign in with Google,” which opens a pixel-perfect copy of Google’s login panel. That page is an adversary-in-the-middle (AitM) proxy: it relays what the victim types to the real Google service in real time over a WebSocket connection, so it captures the password and the MFA challenge while the sign-in appears to work normally. The kit supports Simplified Chinese, Traditional Chinese and English, and Talos assesses with moderate confidence that its developer’s primary working language is Simplified Chinese.
Because the proxy relays a genuine sign-in, Talos says it can intercept the MFA challenge along with the password, leading to full account takeover. Talos has published indicators of compromise on GitHub for defenders to block.