Cisco Talos has published a report on UAT-11985, a phishing campaign that uses AI-assisted event invitations and an adversary-in-the-middle (AitM) kit to capture Google account credentials and session tokens from staff at Taiwanese research institutions. The kit intercepts multi-factor authentication codes in real time, so accounts can be taken over even when MFA is enabled.
Taiwan Research Institutions Targeted With Fake Event Invitations
Talos tracks the activity under the designation UAT-11985 and sees Simplified Chinese language indicators. The company has not attributed it to a named state group. The targets are staff at the Taiwan European Union Centre, the Institute of International Relations at National Chengchi University (NCCU) and the Taiwan Research Institute.
The report places the impact as account takeover and espionage exposure for policy researchers at these organizations, despite the use of MFA.
AI-Assisted Emails and Altered QR Codes on Event Posters
The lures take two forms. One is AI-assisted email that mimics event invitations. The other is altered QR codes placed on legitimate event posters. Both lead victims to fake Google Forms or Google sign-in pages. The pages appear in Simplified Chinese, Traditional Chinese and English, matching the language mix of the organizations being targeted.
Altering a QR code on a real poster ties the phishing attempt to a real event, which makes the request to scan and sign in look routine for attendees.
How the AitM Kit Intercepts MFA Codes in Real Time
The adversary-in-the-middle kit relays the victim’s session to Google using HTTP POST and WebSocket connections. Because it sits between the victim and the genuine service, it passes along what the victim types, including the MFA code, as it is entered.
Credentials and Authenticated Session Tokens Captured
The kit captures both the credentials and the authenticated session tokens. A session token lets the attacker act as the signed-in user without needing the password or a second factor again for that session.
Authentication Interception, Not a Google Vulnerability
Talos stresses that the campaign abuses authentication interception and does not exploit a vulnerability in Google services. The weakness lies in how a user can be led to enter credentials on a page the attacker controls, not in a flaw in Google’s products.
Sources Differ on When the UAT-11985 Campaign Ran
The two reports covering the Talos findings do not agree on timing. One places the campaign activity in mid-2026, and the other says October 2026. The Talos report itself was published on October 12, and the exact period of activity remains unclear from the coverage available.
Detection Signatures and Indicators From Talos
Talos released ClamAV and Snort signatures and indicators so defenders can detect the activity. The signatures cover the network and file artifacts of the campaign, giving security teams a starting point for hunting.
The report does not state how many staff received the lures or how many accounts were compromised. It also does not say what data was taken from any affected account after login.
What the report does establish is the method. The combination of AI-assisted lure writing, trilingual phishing pages, poster-based QR codes and real-time relay of MFA codes shows an attacker adapting phishing to the language and event calendar of a specific community. The targeting of a European Union centre, an international relations institute and a research institute points to organizations that work on policy topics, which is consistent with the espionage exposure Talos describes.
The use of WebSocket connections alongside HTTP POST is what allows the kit to pass codes through live, which is the feature that separates this kit from simpler credential-harvesting pages that only store what a victim types.
