A spear-phishing campaign tracked as UAT-11985 is using fabricated event invitations and counterfeit Google sign-in pages to pursue Google account takeovers among people affiliated with research organizations in Taiwan.
The activity was first observed in mid-2026, according to The Hacker News’s report on Cisco Talos findings. The attackers combine credible public-event material with an adversary-in-the-middle, or AitM, proxy designed to capture credentials and multi-factor authentication challenges while communicating with Google’s legitimate authentication service.
The reporting does not quantify the campaign’s targets or establish how many accounts, if any, were successfully compromised.
Invitations impersonate Taiwanese research and policy institutions
The emails present themselves as invitations to geopolitical or public-policy events. Sender identities are fabricated to resemble three institutions:
- Taiwan European Union Centre
- NCCU Institute of International Relations
- Taiwan Research Institute
Some messages incorporate genuine or plausible event information. The embedded registration link leads to attacker-controlled infrastructure, although Talos reported that hovering over it can display what appears to be a legitimate Google Forms address.
A subset of the campaign uses QR-code phishing, often called quishing. In these cases, the attackers take authentic event posters from legitimate websites and replace the original QR code with one that directs scanners to the malicious site. Talos warned that this technique could also reach people who encounter printed copies of the altered material, extending the risk beyond the initial email recipients.
Cisco Talos assessed that AI likely assisted in producing the lure content. That conclusion is based on structural similarities across messages covering different geopolitical subjects, rather than confirmed access to the attackers’ production process.
The emails reportedly follow a recurring three-part format: an extensive discussion of the event’s policy context, personalized praise intended to encourage the recipient to respond, and logistical details such as the topic, venue and registration process. Talos interpreted the repeated narrative and rhetorical patterns as evidence of a coordinated campaign using a reusable template.
The proxy relays credentials and MFA prompts in real time
After following the registration link, the recipient sees a page styled as a Google Form. A pop-up then asks the user to authenticate with a Google account before completing the form.
The next page closely reproduces Google’s login panel. According to the reported Talos analysis, obfuscated JavaScript collects information about the visitor before opening a WebSocket connection, including:
- Browser locale
- User agent
- Screen dimensions
- Whether the visitor is using a mobile device
The page sends that profile to the command-and-control server through a request named google_login_start.
When the user submits a password, the page issues another request, google_login_check, containing the password, account identifier and browser user agent. The attacker’s HTTP C2 server forwards the authentication data to Google, while the malicious page uses its WebSocket connection to mirror changes in the legitimate login process.
This arrangement allows the victim to see authentication steps that appear to behave normally. At the same time, the attackers can receive credentials and relay MFA challenges as they occur. Talos described the objective as obtaining enough authentication material for a full account takeover without visibly interrupting the login flow.
Because the attack operates as a live relay, an MFA code is not necessarily protective if the user enters it into the counterfeit panel. The code can be passed to the legitimate service during the same session.
Language support suggests a broader Chinese-speaking focus
The spoofed pages support Simplified Chinese (zh-CN), Traditional Chinese (zh-TW) and English. Talos said this “strongly suggests” an interest in Chinese-speaking users, but the language options are an indicator of intended reach rather than confirmation of every victim’s identity or location.
The documented targeting remains focused on individuals connected to Taiwanese research organizations and interested in geopolitical or policy matters. Institutional branding, recipient-specific praise and recognizable public events provide the social context intended to make an unexpected authentication request appear routine.
How recipients can reduce the risk
Recipients should treat sign-in prompts reached through unsolicited event invitations or QR codes as potentially hostile, even when the surrounding event details and poster are authentic. Rather than authenticating through the invitation, users can navigate to the institution or event organizer through a separately obtained address and confirm the registration process there.
The browser’s actual address bar deserves particular attention at the moment credentials or an MFA challenge are requested. Visual accuracy is not evidence that a page belongs to Google, and the campaign is specifically designed to reproduce the legitimate authentication experience.
Anyone who entered Google credentials or an MFA response after opening one of these invitations should promptly notify the relevant security or account administrator. Administrators can then review account activity and active sessions through their established incident-response process rather than relying only on a password change.
The malicious QR-code variation also means the same caution applies to posters and printed invitations: a genuine-looking event document does not guarantee that its QR destination is legitimate.
