UAT-11985 targets Taiwan researchers with fake event invites and Google AitM phishing

A newly tracked advanced persistent threat (APT) cluster dubbed UAT-11985 is targeting people affiliated with Taiwanese research organizations with fake event invitations designed to steal Google account credentials and multi-factor authentication (MFA) codes, The Hacker News reported on October 16, citing an analysis by Cisco Talos researcher Joey Chen. Talos assesses that the campaign, first observed in mid-2026, is likely fueled by AI-assisted content generation, allowing the attackers to quickly produce tailored lures.

What happened

According to the report, the emails use legitimate or plausible public event details and impersonate academic and policy institutions, including the Taiwan European Union Centre, the NCCU Institute of International Relations and the Taiwan Research Institute, with fabricated sender identities. Talos found that the messages share a nearly identical three-part structure across different geopolitical topics: an elaborate context description, personalized flattery and event logistics with registration instructions. That consistency suggests mass production from a reusable template.

In some cases the attackers also used QR-code phishing, taking scraped legitimate event posters and replacing their QR codes. Talos noted that printed copies of such posters could reach secondary victims beyond the original email recipients.

Technical details

The email link appears to point to a Google Forms address when hovered over, but leads to attacker infrastructure. The victim sees a page imitating a Google Form, followed by a pop-up asking them to sign in with Google to complete it, and then a spoofed Google login page hosted as an adversary-in-the-middle (AitM) proxy. The proxy captures credentials and authentication challenges and forwards them to Google's real servers, so the login appears to succeed while the attacker takes over the account.

The Hacker News said obfuscated JavaScript collects the victim's locale, user agent, screen size and mobile status and reports them through a google_login_start request, while passwords and account identifiers go out via google_login_check. A WebSocket connection mirrors the authentication state in real time. The login panels support Simplified Chinese, Traditional Chinese and English, and region detection based on navigator.languages suggests a focus on Chinese-speaking users, Talos said. The report does not attribute the cluster to any country.

Who is affected

The campaign targets researchers, academics and others connected to Taiwanese research and policy institutions, though the reusable template means similar lures could be aimed at other groups.

What to do

• Verify event invitations through an independent channel before registering or signing in.
• Treat QR codes on posters and in emails with the same caution as links.
• Check the real domain of any Google sign-in page; a Google Form should not redirect to a third-party login.
• Use phishing-resistant MFA such as hardware security keys or passkeys, since AitM proxies can relay one-time codes, and monitor accounts for unexpected sessions.