UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
Summary: Cisco Talos disclosed a spear-phishing campaign tracked as UAT-11985 that targets individuals affiliated with Taiwan research organizations, using fake event invitations to route victims to an adversary-in-the-middle phishing framework that harvests Google credentials and MFA codes. First observed in mid-2026, the operation impersonates institutions including the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute, and in some cases modifies legitimate event posters with malicious QR codes.
Bottom line: The phishing site relays stolen credentials to Google's real authentication servers in real time over a WebSocket connection, so the victim completes a genuine-looking login and the attacker achieves full account takeover without triggering suspicion. Talos notes the spoofed login panels support only Simplified Chinese, Traditional Chinese, and English, pointing to deliberate targeting of Chinese-speaking users.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026