Fake Event Invites Used to Steal Google Logins and MFA Codes From Taiwan Research Circles

Cisco Talos has disclosed a spear-phishing campaign, tracked as UAT-11985, that targeted people affiliated with Taiwan research organisations. Victims were directed to an adversary-in-the-middle phishing framework built to harvest Google account passwords and multi-factor authentication (MFA) codes. Talos says the campaign was first seen in mid-2026 and was likely helped by AI-generated content, which let the actor quickly produce tailored lures within one common social engineering framework.

The emails used real or believable public event themes and impersonated respected institutions, including the Taiwan European Union Centre, NCCU Institute of International Relations and Taiwan Research Institute. A link in each message pointed to attacker-controlled infrastructure, yet hovering over it showed a legitimate-looking Google Forms address. Despite covering a range of geopolitical topics, the invitations shared almost identical structure and style, suggesting a reusable prompt template. Talos researcher Joey Chen noted the actor also used QR code phishing, altering genuine event posters with malicious QR codes. That approach reaches beyond email recipients to anyone who sees printed materials.

Talos concluded that the repeated narrative, personalised flattery, institutional impersonation and deceptive registration process point to a coordinated and carefully targeted campaign, not separate invitations. The tactics are not limited to research bodies: any business could face convincing invitations that borrow trusted names.