UAT-11985: AI-Assisted Spear-Phishing Campaign Targets Taiwan Researchers with Google Credential Theft

Cisco Talos on October 16, 2026 disclosed a spear-phishing campaign tracked as UAT-11985 that targets individuals affiliated with Taiwan research organizations, using lures the researchers assess were likely fueled by artificial intelligence (AI)-assisted content generation and a spoofed Google login page that steals credentials and MFA codes in real time, according to The Hacker News. The campaign was first observed in mid-2026, and its lures impersonated three Taiwan-based institutions: the Taiwan European Union Center, the NCCU Institute of International Relations, and the Taiwan Research Institute.

What was the specific vulnerability?

The core technique was an adversary-in-the-middle (AitM) credential-harvesting proxy that intercepted Google sign-in data while simultaneously relaying it to Google's genuine authentication servers. According to The Hacker News, which carries the Talos analysis, the phishing site first imitated a Google Form, then prompted a Google sign-in that led to a pixel-perfect spoofed Google login panel. Obfuscated JavaScript on that panel exfiltrated entered credentials and MFA challenges in real time over a WebSocket connection while forwarding them to the real Google authentication service, enabling full account takeover without the victim noticing anything wrong.

The exfiltration ran over two channels. Device and browser data, including locale, user agent, screen dimensions and mobile status, was sent to the command-and-control server through a google_login_start request. The password, account identifier and user-agent then traveled through a google_login_check HTTP request before being relayed to Google's real authentication servers. The spoofed login panels supported only Simplified Chinese (zh-CN), Traditional Chinese (zh-TW) and English, with region detection via the browser's navigator.languages property, which Talos researcher Joey Chen said was "strongly suggesting targeting of Chinese-speaking users."

How was the incident detected?

Cisco Talos detected and tracked the campaign, with researcher Joey Chen publishing the analysis on October 16, 2026, after the activity was first observed in mid-2026. The quotations and technical figures in this article are as carried by The Hacker News in its October 16, 2026 writeup of the Talos report. The underlying Cisco Talos blog post is the primary source but could not be read directly for this article, so every Talos claim below rests on The Hacker News's account of it.

Talos's structural analysis of the emails led it to a hedged assessment about how the lures were produced. According to the report, the lures were mass-produced from a reusable prompt template and showed nearly identical syntactic structure across invitations on widely differing geopolitical topics. Each email followed the same three parts: an "overly elaborate" geopolitical or policy context, recipient-specific flattery, and event logistics covering topic, date, venue and registration instructions. Talos assessed that the combination "strongly suggests a coordinated and carefully targeted spear-phishing campaign rather than three independent invitations," and separately assessed that the lures were "likely fueled by artificial intelligence (AI)-assisted content generation."

Chen described the social-engineering layer: "The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility." He also noted that the actor "incorporated QR code phishing (quishing) techniques by modifying legitimate event posters with malicious QR codes," extending the attack to secondary victims who encounter printed materials.

What is the current impact?

The immediate impact is full Google account takeover for targeted individuals who entered credentials on the spoofed panel. Because the AitM proxy captured both passwords and MFA challenges as they were typed, second-factor prompts offered no protection to victims who completed the fake sign-in. The harvested material consisted of Google account credentials and authentication codes; the campaign did not deploy a malware implant, so the compromise lives or dies with the credentials themselves.

The targeting focused on individuals affiliated with Taiwan research organizations, with the locale restrictions on the fake login panels pointing, per the Talos assessment carried by The Hacker News, to a deliberate focus on Chinese-speaking users. Neither Talos nor The Hacker News published a victim count in the material available at disclosure, so the number of compromised accounts remains undisclosed. The impersonation of named institutions, including the NCCU Institute of International Relations, also carries a reputational cost for the organizations whose event brands were borrowed.

What are the next steps?

No patch applies, so mitigation rests on credential resets, phishing-resistant MFA and takedown of the AitM infrastructure. Anyone who entered credentials on a spoofed Google panel tied to this campaign should treat the account as compromised and rotate the password immediately, since the harvested credentials and MFA codes were relayed to the attacker in real time. Phishing-resistant MFA, such as hardware security keys, is the structural defense against AitM proxies, which are built specifically to defeat one-time codes relayed through a fake login flow.

For the targeted community, the practical defenses are verification and skepticism toward event invitations. Recipients of invitations claiming to come from the Taiwan European Union Center, the NCCU Institute of International Relations or the Taiwan Research Institute should confirm the event independently through the institution's own channels before registering. The quishing element adds a second surface: QR codes on event posters should be treated as untrusted links, since Talos documented the actor modifying legitimate posters with malicious codes. Defenders and hosting providers can also contribute by reporting and taking down the AitM infrastructure, which removes the collection endpoint even if new lures continue to circulate.

By the numbers

Source snapshot