# UAT-11985 uses fake event invites to hit Taiwan research affiliates with Google AitM phishing

Source: https://startwithidentity.com/blog/2026-10-08-uat-11985-fake-event-invites-target-taiwan-researchers-with-google-aitm-phishing/
Last updated: 2026-10-08
License: content by Start with Identity. Cite the source URL.

---

Cisco Talos is tracking a spear-phishing campaign, designated UAT-11985 and first seen in mid-2026, aimed at people affiliated with Taiwanese research organizations. The emails invite targets to real or plausible public events and borrow the names of the Taiwan European Union Centre, the NCCU Institute of International Relations and the Taiwan Research Institute, with fabricated senders. Links look like Google Forms URLs, and in some cases genuine event posters were republished with the QR code swapped for a malicious one. The fake form asks the victim to sign in with Google, then shows a replica login page that relays credentials and MFA challenges to Google in real time, using HTTP POST for submissions and a WebSocket to steer the victim's screen, so the attacker can capture an authenticated session. Talos assesses with moderate confidence that the kit's developer is a native Simplified Chinese speaker.

## Why it matters

The kit is a standard [adversary-in-the-middle proxy](https://startwithidentity.com/techniques/aitm-phishing-proxy/): the victim completes a real Google sign-in through the attacker, so a one-time code or prompt approval protects nothing, and the prize is the session that results. Researchers, think-tank staff and anyone who regularly registers for events are the target pool, and the swapped QR codes on posters move the lure onto phones, where the destination URL is harder to inspect.

For organizations with staff in this profile, the effective control is a factor that is bound to Google's real origin. Enrolling at-risk users in [passkeys](https://startwithidentity.com/glossary/passkey/) or security keys, and in Google's Advanced Protection Program where appropriate, closes the relay. If an account may already be exposed, sign out all sessions and review recent sign-in activity, because a captured session survives a password change until it is revoked. See [session cookie theft](https://startwithidentity.com/techniques/session-cookie-theft/) for what an attacker does next.

Source: [The Hacker News](https://thehackernews.com/2026/10/uat-11985-uses-fake-event-invites-to.html)