UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
Cisco Talos says UAT-11985 uses fake event invites and Google AitM phishing against Taiwan research affiliates.
Cisco Talos is tracking UAT-11985, an APT cluster spear-phishing people affiliated with Taiwan research organizations since mid-2026. The actor impersonates institutions including the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute, using public event themes, Google Forms-looking links, and QR codes swapped onto legitimate posters. Victims reach an adversary-in-the-middle proxy that mimics Google login in Simplified Chinese, Traditional Chinese, and English, then relays passwords and MFA challenges to Google over HTTP and WebSocket for real-time account takeover. Talos says nearly identical email structure indicates template-driven, likely AI-assisted lure generation.