Cisco Talos documented a spear-phishing campaign, tracked as UAT-11985, that targets people affiliated with Taiwan research organizations using forged academic event invitations and a real-time Google login relay capable of capturing multi-factor authentication codes.
How the lure works
Operators impersonated the Taiwan European Union Centre, National Chengchi University’s Institute of International Relations, and the Taiwan Research Institute, reusing plausible public event themes while fabricating sender identities, Talos said. Recipients who checked with the institutions found the named staff did not exist.
Emails followed a repetitive three-part structure: policy jargon opening, flattery with few verifiable details, and logistics copied from real conferences with a malicious registration link. In one sample, visible text resembled a Google Forms address while the hyperlink pointed to attacker infrastructure.
Adversary-in-the-middle kit
The phishing pages impersonate Google sign-in in Traditional Chinese, Simplified Chinese, and English, using HTTP posts and WebSockets to relay credentials and MFA challenges live. Talos said operators can present the correct second-factor prompt as Google does, then harvest session tokens for full account takeover.
Modified QR codes on copied event posters extend the funnel beyond email recipients if posters are printed and scanned in public spaces.
Why Taiwan researchers
Think tanks and university institutes handle cross-strait and Indo-Pacific policy work, making their inboxes high-value for espionage. Compromised Google Workspace accounts can expose draft papers, donor lists, and travel itineraries for visiting scholars.
Talos assesses with moderate confidence that the kit’s interface was authored by a native Simplified Chinese speaker later localized—language inference, not formal attribution to a named state group.
Defender actions
Talos published ClamAV signatures, Snort rules, and indicators including domains such as natrlyi.com and morelessty.com. Security teams should hunt for mismatches between displayed and actual URLs in registration emails and for WebSocket traffic to untrusted hosts during Google logins.
Organizations should prioritize FIDO2 security keys over SMS or app-based one-time codes for high-risk users, and train staff to verify invitations through official institute switchboards rather than reply-to addresses.
Institutional response
Affected institutes can issue signed calendars for real events and host registration only on verified subdomains. For National Day week travel, researchers should delay clicking conference links on airport Wi-Fi and use dedicated devices for policy work.
Taiwan’s digital ministry and academic networks have improved phishing reporting pipelines, but live-relay kits raise the bar—blocking domains is necessary yet insufficient if operators rotate faster than blocklists update.
Campus IT playbooks
University IT teams are staging mandatory password rotations for research fellows returning from National Day travel and requiring hardware keys for anyone with access to embargoed policy drafts. Shared lab inboxes are being switched to read-only archives when faculty depart, reducing the blast radius if a legacy account is compromised.