A cyber espionage campaign tracked as UAT-11985 has been targeting people associated with research organizations in Taiwan through fake event invitations. According to Cisco Talos, the attackers use convincing emails that appear to come from respected academic and policy institutions. The messages contain details about real public events, making them difficult to identify as fraudulent. The campaign was observed in mid-2026 and uses a sophisticated phishing technique designed to steal Google account credentials.
The attackers impersonated three organizations: the Taiwan European Union Centre, the Institute of International Relations at National Chengchi University, and the Taiwan Research Institute. The invitations included professional-looking descriptions, event information, registration instructions, and personalized compliments to attract recipients. When the organizations were contacted for verification, none could confirm that the listed senders worked for or represented them. The attackers appear to have used publicly available information to make their messages look authentic.
Cisco Talos found that the emails followed a similar structure, beginning with discussions about geopolitical issues before using flattery to gain the recipient’s interest. The final section provided event details and registration links that appeared legitimate but redirected users to attacker-controlled websites. Researchers also identified signs of possible artificial intelligence assistance in the writing, including repetitive language and similar sentence structures. However, the evidence does not conclusively prove that the emails were entirely generated by AI.
The campaign also uses QR code phishing, commonly known as quishing, to reach potential victims beyond email. The attackers copied legitimate event posters and replaced their original QR codes with malicious ones. People scanning these altered codes could be redirected to fraudulent websites, including individuals who encountered printed posters in offices or other locations. This technique expands the campaign’s reach by exploiting the trust people place in familiar event posters and registration materials.
The phishing website initially imitates Google Forms before redirecting victims to a fake Google sign-in page that closely resembles the genuine service. Cisco Talos found that the fraudulent interface supports Simplified Chinese, Traditional Chinese, and English, with the displayed language selected using browser language settings. The attackers use an adversary-in-the-middle (AitM) technique, placing their infrastructure between the victim and Google’s legitimate authentication service. This allows them to relay login information and multi-factor authentication challenges in real time, potentially capturing authenticated session tokens.
The investigation highlights how convincing social engineering and advanced phishing technology can work together to compromise online accounts. Organizations should verify unexpected invitations directly with the institution involved and carefully inspect the actual destination of registration links. Users should also avoid scanning QR codes from unverified posters and should never assume that a familiar Google sign-in page is genuine simply because it looks correct. Cisco Talos has published technical detection information for security teams to help identify this campaign and strengthen their defenses against similar attacks.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
