In a recent disclosure, cybersecurity experts have unveiled an intricate phishing campaign targeting individuals linked to Taiwan’s research sector. This operation, tracked as UAT-11985 by Cisco Talos, employs an adversary-in-the-middle (AITM) phishing framework to illegally obtain Google account credentials and multi-factor authentication (MFA) codes.
AI-Driven Phishing Tactics
Cisco Talos researchers suggest that artificial intelligence (AI) plays a crucial role in crafting these deceptive messages, enabling the rapid creation of customized lures. First detected in mid-2026, the campaign uses the guise of legitimate events and impersonates well-known academic and policy institutions to appear credible.
Joey Chen, a researcher from Talos, highlights the use of advanced techniques such as QR code phishing, or ‘quishing,’ which involves altering authentic event posters with malicious QR codes. This strategy broadens the attack’s reach beyond email recipients to anyone who encounters these modified posters.
Sophisticated Spear-Phishing Techniques
The phishing emails are meticulously structured, incorporating real event information and hyperlinks that seem legitimate at first glance. These emails follow a three-part format: an elaborate description of the geopolitical context, personalized flattery for the recipient, and logistical details about the event, including registration instructions.
In an effort to deceive, the attackers impersonate reputable Taiwan-based entities such as the Taiwan European Union Centre and NCCU Institute of International Relations. By doing so, they enhance the credibility of their phishing attempts, making them appear as genuine invitations rather than suspicious solicitations.
Technical Execution and Impact
Once victims click on the phishing link, they are led to a fake Google Form that closely mimics the real thing. The primary objective is to collect login credentials through a spoofed Google login panel. This AITM proxy uses obfuscated JavaScript to capture and siphon off entered data in real-time.
The JavaScript payload also gathers device-specific information, like locale and browser details, which are then sent to a command-and-control (C2) server. The phishing scheme is tailored to Chinese-speaking users, supporting Simplified Chinese, Traditional Chinese, and English languages.
Overall, this targeted phishing campaign showcases the evolving sophistication of cyber threats, highlighting the need for heightened security measures and awareness among potential targets. As threat actors continue to refine their methods, organizations must remain vigilant to protect sensitive information from unauthorized access.
