Cisco Talos researchers warned that a spear-phishing cluster tracked as UAT-11985 has been impersonating Taiwan academic institutions with fabricated conference invitations that route victims through a real-time Google adversary-in-the-middle phishing kit capable of harvesting passwords, multi-factor prompts, and authenticated session tokens. The campaign, observed since mid-2026, is the latest reminder that MFA alone does not stop proxy attacks against browser-based logins.
How the lure works
Emails reuse plausible event themes and venue details while hyperlinking to attacker-controlled domains that mimic Google Forms registration pages. Talos noted nearly identical rhetorical scaffolding across messages targeting different researchers, suggesting AI-assisted template generation even though the firm stopped short of attributing full authorship to a large language model.
Impersonated senders claimed ties to the Taiwan European Union Centre, National Chengchi University’s Institute of International Relations, and the Taiwan Research Institute—names chosen to blend policy and academic credibility. Some lures included QR codes on modified posters, a “quishing” variant that bypasses URL filters tuned for plain links.
Technical mechanics
Once victims click through, obfuscated JavaScript loads a pixel-close Google sign-in panel supporting Traditional Chinese, Simplified Chinese, and English locales selected from browser language settings. Unlike static phishing pages, the framework synchronizes authentication state with Google’s real endpoints, forwarding one-time codes or push approvals before exfiltrating session cookies that can be replayed from another device.
Talos published indicators including domains such as morelessty.com, centerhoti.com, and natrlyi.com, along with Snort and ClamAV signatures. Threat hunters recommend blocking those hosts at DNS and proxy layers and searching logs for google./accounts. patterns on non-Google infrastructure.
What Taiwan campuses should do
Information-security officers at Taipei research parks said they are reissuing guidance to verify invitations through known switchboard numbers rather than reply-to addresses embedded in messages. Several universities plan mandatory passkey pilots for faculty Google Workspace accounts, following Google’s guidance that phishing-resistant factors bind credentials to legitimate origins.
Incident responders stressed that password resets without global session revocation leave stolen cookies valid. Compromised accounts require forced sign-out of all devices and review of OAuth grants installed during the attacker’s window.
Attribution and outlook
Talos assesses with moderate confidence that the kit’s interface strings suggest a Simplified Chinese-speaking developer, but the firm has not tied UAT-11985 to a named state sponsor. Taiwan’s Ministry of Digital Affairs has not issued a public alert specific to the cluster as of October 17, though campus CERT teams are sharing Talos indicators privately.
For Taiwan’s research community, the operational lesson is familiar: geopolitical tension increases interest in policy institutes, and modern phishing kits have closed the gap between credential theft and session hijacking. Event season this autumn will test whether passkey rollouts move faster than lure sophistication.