A Cisco Talos research team has tied a spear-phishing run against Taiwan research organizations to an adversary-in-the-middle proxy that steals Google passwords and one-time codes in the same session they are typed.
The cluster is tracked as UAT-11985 and dates to mid-2026. Talos’s Joey Chen said the operation borrowed real public event themes and impersonated credible academic and policy bodies, including the Taiwan European Union Centre and the NCCU Institute of International Relations, to make invitations believable.
What separates this run from ordinary credential phishing is the template. Invitation emails carry nearly identical syntax whatever the geopolitical topic, pointing to mass production from a reusable prompt rather than hand-written lures. Talos attributes the speed to AI-assisted content generation.
Posters that ask for a scan
Some messages used genuine conference posters scraped from the web, with the printed QR codes swapped for attacker ones. Anyone who scans, including people who never received the email, lands on a page dressed as a Google Form.
Trying to sign in triggers a pixel-perfect replica of Google’s login. Obfuscated JavaScript relays credentials to Google in real time over a WebSocket while copying them to the operator’s server, so the victim’s actual account authenticates normally and no alarm fires. The fake panels only support Chinese and English locales.
Defenders should block lookalike form domains, enforce phishing-resistant keys where possible, and train staff that a poster QR code is an untrusted link.
