Cybersecurity researchers have uncovered details of an advanced persistent threat (APT) campaign tracked as UAT-11985 that has targeted individuals affiliated with Taiwan research organisations through sophisticated spear phishing techniques. The campaign uses fake event invitations, QR code phishing, and an adversary-in-the-middle (AitM) framework designed to capture Google account credentials and multi-factor authentication (MFA) codes. According to Cisco Talos researchers, the activity was first observed in mid-2026 and appears to use artificial intelligence (AI) assisted content generation to quickly create customised social engineering messages targeting different individuals while maintaining a similar campaign structure.
The campaign relies on realistic looking event invitations and impersonation tactics to establish credibility with potential victims. Researchers said the threat actors used public event themes and posed as representatives of recognised academic and policy institutions to make phishing messages appear legitimate. The emails included links that directed recipients toward attacker-controlled infrastructure while displaying URLs that appeared similar to legitimate Google Forms pages. In several cases, the campaign also expanded beyond email-based attacks by modifying genuine event posters obtained from public sources and replacing original QR codes with malicious ones. Victims scanning these QR codes were redirected to phishing pages designed to collect account information under the appearance of event registration processes.
Cisco Talos researchers noted that the phishing emails followed a consistent structure despite covering different geopolitical and policy topics. The messages typically contained an introduction describing an event or policy discussion, a personalised section designed to attract the recipient’s interest, and final details covering registration information, dates, locations, and participation instructions. This repeated format indicates that the messages may have been created using reusable templates rather than individually written for every target. The campaign reportedly impersonated Taiwan based institutions, including the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute, by using fabricated sender identities to increase the credibility of the invitations. Researchers said the combination of institutional impersonation, personalised messaging, and deceptive registration methods suggests a coordinated phishing operation.
The phishing infrastructure used in the campaign was designed to replicate legitimate Google Forms and Google login experiences. According to Cisco Talos analysis, the fake pages prompted users to sign in with their Google accounts before completing the registration process. The copied login interface acted as an AitM proxy, allowing the attackers to collect entered information while simultaneously forwarding authentication requests to legitimate Google services. Researchers found that the infrastructure used obfuscated JavaScript to collect and transmit information through WebSocket connections, enabling real-time communication between the phishing site and attacker-controlled servers. Before authentication attempts began, the script collected device and browser information, including language settings, user agent details, screen dimensions, and mobile device status, which were sent to command and control infrastructure.
During the credential collection process, submitted passwords, account identifiers, and browser information were transmitted through attacker-controlled systems before being forwarded to Google authentication services. Researchers explained that this approach allowed the attackers to mirror authentication activity and potentially capture MFA information without immediately alerting victims. The spoofed Google login pages supported Simplified Chinese, Traditional Chinese, and English language settings, with regional preferences determined through browser language settings, indicating that Chinese-speaking users were among the intended targets. The campaign highlights the continued evolution of phishing operations, where attackers combine social engineering, AI assisted content creation, QR code techniques, and advanced credential harvesting methods to improve the effectiveness of their attacks.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
