Campus information-security teams circulated an alert this week that criminals are abusing legitimate “email this article” widgets on Taiwanese government sites to deliver phishing pages from authentic .gov.tw senders, a technique that clears SPF and DKIM checks because the message actually originates on ministry servers, according to a National Dong Hwa University advisory echoing National Institute of Cyber Security warnings.
How the relay trick works
Attackers paste scam text—fake fines, invoice wins, or account verification demands—into optional fields on article-sharing forms. The host system then emails the page link to victims with a government footer intact. Taiwan FactCheck Center reporters demonstrated similar flaws on finance and health portals before some units disabled forwarding. The mail is not forged at the header level; it is weaponized courtesy of a feature designed for public outreach.
Campus exposure
Universities remain high-value targets because .edu.tw addresses trust government mail for grant compliance and tuition refunds. NDHU's security office told faculty to treat payment instructions in relayed messages as untrusted even when the envelope shows a ministry domain. IT desks added sandbox detonation for attachments that mimic Gmail preview panes—a separate China-nexus campaign Talos tracks as UAT-11587 targeting Taiwan policy researchers.
Agency response pace
Finance ministries closed some forwarders after invoice-lottery scams surfaced, yet FactCheck testing found other agencies still exposing share-to-friend fields without rate limits. MODA's joint audit program for government IT contractors, launched in July, includes spot checks on outward email features, but results are not published per site.
What enterprises should do
Security operations centers should flag anomalous volumes from single government forms and train help desks not to whitelist .gov.tw blindly. Phishing callbacks belong on the 165 anti-fraud hotline, not on QR codes embedded in relayed HTML. For researchers receiving tailored lures about legislative pay rules, Talos recommends isolating clicks in disposable VMs and reporting hashes to Taiwan's Computer Emergency Response Team.
Why this matters now
Record equity markets did not reduce fraud attempts; they may have increased them as scammers blend investment and tax themes. Chih-Wei Cheng's desk treats government relay abuse as infrastructure hygiene, not partisan politics—fix the forms or remove them, before a single message triggers a wire transfer.
Incident response
Computer Emergency Response Team Taiwan urged agencies to disable share-to-friend modules until CAPTCHA and rate limits ship. Several ministries said they would audit outbound mail logs for October after NICS circulated a template questionnaire.
Researcher hygiene
Think tanks receiving legislative pay-rule lures should forward headers to security desks before opening attachments. Talos hashes for Antino DLL sideloads are published for endpoint detection tools.