UAT-11985 phishing targets Taiwan research staff’s Google accounts
Cisco Talos has disclosed a spear-phishing campaign, tracked as UAT-11985, that targets people affiliated with Taiwan research organizations and aims to steal Google account credentials and multi-factor authentication (MFA) codes, according to The Hacker News. The reporting does not mention a CVE or a software flaw; the attack relies on social engineering and an adversary-in-the-middle (AitM) phishing framework.
What we know
The Hacker News, citing Talos analysis, reports the following:
- Talos tracks the activity as UAT-11985 and says it was first observed in mid-2026.
- Victims are sent invitations to public events. The link in the email points to attacker-controlled infrastructure, while hovering over it shows a legitimate-looking Google Forms URL.
- The phishing site imitates a Google Form and is designed to capture Google credentials and MFA codes.
- The emails impersonate Taiwan-based institutions, including the Taiwan European Union Centre, NCCU Institute of International Relations and Taiwan Research Institute, using fabricated sender identities.
- Some emails reuse real event posters from legitimate websites, but with the QR codes altered so that scanning one to “register” leads to the malicious page (QR code phishing, or quishing).
Talos says the emails share a near-identical three-part structure: a long description of the policy context, personalised flattery for the recipient, then event logistics and registration instructions. Talos assesses that the content was likely produced with AI assistance from a reusable prompt template, which lets the actor tailor lures quickly.
Who is affected
The stated targets are individuals affiliated with Taiwan research organizations. The number of victims, and whether any accounts were compromised, has not been disclosed in the material we reviewed. Because quishing can reach people who see altered printed or shared posters, recipients of the original email are not the only people exposed.
Why this matters
Analysis, not reported fact. An AitM page relays the login to the real service as the victim types it, so a one-time code from an app or SMS can be captured and replayed. Organizations that treat MFA as a complete answer to phishing should check which factors they allow. Researchers, academics and policy staff are attractive targets because their mailboxes hold contacts and unpublished work, and event invitations are a normal part of their jobs.
What has not been confirmed
- Attribution beyond the UAT-11985 label has not been stated in the source text we reviewed.
- The AI-assisted generation of the lures is Talos’s assessment (“likely”), not a confirmed fact.
- Indicators of compromise were not included in the material available to us, so none are listed here.
What to do
- Warn staff at research, academic and policy organizations about event invitations that ask them to register through a form or QR code, especially from unfamiliar senders.
- Teach users to check the real destination of a link, not the preview text shown on hover, and to verify an event through the organizer’s official website.
- Prefer phishing-resistant MFA such as FIDO2 security keys or passkeys, which are bound to the real site and defeat AitM relays.
- Hunt in mail and proxy logs for recent event-invitation emails whose links resolve to domains outside Google, and for Google sign-ins from unexpected locations or devices shortly after such messages.
- If someone entered credentials or an MFA code on a suspect page, reset the password, revoke active sessions and review account recovery settings and mail forwarding rules.
- Review the original report and the Cisco Talos analysis it cites for indicators to add to your blocklists.
Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.
