Cisco Talos Tracks Google AitM Phishing Kit Targeting Taiwan Researchers
Attackers use live WebSockets to bypass MFA by relaying authentication steps in real time to operators.
Key points
- The campaign targets researchers linked to organizations in Taiwan.
- Cisco Talos identified the activity, tracked as UAT-11985, in mid-2026.
- Phishing emails impersonate academic institutions and use AI-assisted writing.
Cisco Talos researchers identified a sophisticated phishing campaign targeting Google accounts in mid-2026. The operation, tracked as UAT-11985, uses live WebSocket connections to bypass multi-factor authentication by relaying login steps in real time.
The threat group employs an operator-driven system that mirrors Google’s authentication process. According to Cisco Talos, the kit guides victims through fake sign-in screens while forwarding requests to steal authenticated sessions. This approach bypasses security checks rather than breaking them.
Technical Mechanics and Campaign Details
Cisco Talos published findings on October 8 in a threat research report. The analysis revealed that attackers combine HTTP requests with WebSocket updates to maintain control over each authentication stage. Victims encounter a fake Google Form first, which redirects them to a copied sign-in page.
Unlike simple credential harvesting tools, this kit allows operators to manage the login flow dynamically. This method resembles techniques seen in Tycoon 2FA phishing attacks. The system sits between the user and the real authentication service, creating a convincing relay that defeats standard MFA protections.
Targeting Strategy and Indicators
The operation specifically targets individuals linked to research organizations in Taiwan. Attackers send emails posing as invitations to academic and policy events. According to Cyber Security News, the messages use real event details to build trust while hiding malicious registration links.
The fake emails impersonate the Taiwan European Union Centre, NCCU Institute of International Relations, and the Taiwan Research Institute. When recipients verified the senders with these institutions, none could confirm the individuals were employees. The attackers used accurate event information to make the fabricated identities appear legitimate.
Social Engineering and AI Usage
Each message followed a consistent pattern with a policy-themed opening and tailored praise. Cisco Talos noted signs of AI-assisted writing, such as repeated sentence patterns and broad compliments. However, researchers could not prove that a large language model generated the complete emails.
The finding supports likely AI assistance rather than confirmed fully automated content generation. Attackers also copied legitimate event posters and replaced QR codes with malicious ones. This tactic risks exposing additional people who scanned printed posters but never received the original email.
What should you do?
Security teams should monitor for unusual WebSocket connections originating from user browsers. Organizations in Taiwan’s research sector should verify event invitations through official channels. Users should be cautious of QR codes on physical posters that redirect to unexpected domains.
Background: Large language models
Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.
What to do and how to stay safe: Google
- Verify the identity of senders claiming to represent academic or policy institutions through independent contact methods.
- Monitor network logs for WebSocket connections that do not align with known application traffic patterns.
- Inspect QR codes on physical materials before scanning them to ensure they lead to expected destinations.
- Educate staff to recognize AI-generated text patterns, such as generic compliments and repetitive sentence structures.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does this phishing kit bypass multi-factor authentication?
It uses live WebSocket connections to relay authentication requests in real time, allowing an operator to guide the victim through the login process.
Which organizations are being impersonated in these emails?
The attackers impersonate the Taiwan European Union Centre, NCCU Institute of International Relations, and the Taiwan Research Institute.
Did Cisco Talos confirm the use of AI for writing the emails?
No, researchers noted signs of AI assistance but could not prove that a large language model wrote the complete emails.
