UAT-11985 Targets Taiwan Researchers With AI-Generated Google Phishing Campaign
An APT group is using AI-crafted fake event invites and QR codes to steal credentials and MFA codes from Taiwan research affiliates via AitM phishing.
Key points
- Cisco Talos tracks the UAT-11985 campaign targeting Taiwan research organizations.
- Attackers use AI-assisted templates to create bespoke lures impersonating academic institutions.
- The operation employs adversary-in-the-middle phishing to harvest Google credentials and MFA codes.
Cisco Talos researchers disclosed an advanced persistent threat campaign tracked as UAT-11985 that targets individuals affiliated with Taiwan research organizations. First observed in mid-2026, the operation uses artificial intelligence to generate spear-phishing lures designed to steal Google account credentials and multi-factor authentication codes through an adversary-in-the-middle framework.
The campaign leverages legitimate public event themes and impersonates reputable academic and policy institutions to establish credibility with victims, according to Talos researcher Joey Chen. Beyond traditional email attacks, the actor incorporates QR code phishing techniques by modifying legitimate event posters with malicious codes, expanding the attack surface to secondary victims who encounter printed materials.
Tactics and Techniques
Central to the operation is the use of plausible public event information in spear-phishing emails that embed URLs pointing to attacker-controlled infrastructure. Hovering over these hyperlinks displays a legitimate-looking Google Forms URL to deceive recipients. These invitation emails feature nearly identical syntactic structures despite covering various geopolitical topics, indicating the content was mass-produced from a reusable prompt template rather than crafted individually.
The emails follow a specific three-part structure to maximize engagement. The opening section offers a polished but overly elaborate description of the geopolitical or policy context. The second section tailors the message to the recipient, painting them in a flattering light to trigger engagement. The final section provides event logistics, including the topic, date, venue, and registration instructions.
Who Is Affected
The threat actor has impersonated legitimate Taiwan-based institutions to fabricate sender identities and make messages appear more convincing. Targeted organizations include the Taiwan European Union Centre, the NCCU Institute of International Relations, and the Taiwan Research Institute. This activity mirrors broader trends in social engineering, as Threat Times reported on 2026-10-16 that attackers use fake verification steps to bypass security tools and trick users.
What should you do?
Security teams should monitor for unsolicited event invitations, particularly those containing QR codes or links to Google Forms. Verify the authenticity of such communications through independent channels before clicking any links or scanning codes. Organizations should enforce strict multi-factor authentication policies and educate staff on recognizing AI-generated social engineering templates.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: UAT-11985
- Verify the source of any unsolicited event invitation by contacting the purported organizer through known, trusted channels.
- Inspect URLs carefully before clicking; do not trust hover text or display names, as attackers can spoof legitimate-looking addresses.
- Avoid scanning QR codes from unverified physical or digital posters, as they can redirect to adversary-in-the-middle phishing pages.
- Monitor user accounts for unusual login activity or new sessions, which may indicate compromised credentials despite MFA use.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does UAT-11985 bypass multi-factor authentication?
The group uses an adversary-in-the-middle phishing framework that captures both credentials and MFA codes in real-time during the login process.
What signs indicate an email is part of this campaign?
Emails often have identical syntactic structures, overly elaborate geopolitical descriptions, and impersonate reputable Taiwan-based academic or policy institutions.
Are QR codes used in this attack?
Yes, attackers modify legitimate event posters with malicious QR codes to target secondary victims who encounter the printed materials.
