Researchers at Cisco Talos have detailed a spear-phishing campaign, tracked as UAT-11985, that targets people affiliated with Taiwan research organizations. The attackers send fake event invitations built around legitimate public event themes and impersonate institutions such as the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute.
According to Talos, the emails follow a nearly identical three-part structure: a polished geopolitical context, personalized flattery aimed at the recipient, and event logistics with registration instructions. That repetition suggests the content was generated from a reusable AI-assisted prompt template rather than written individually. In some cases, the actors modified legitimate event posters to include malicious QR codes, so people who encountered printed materials could also be steered to the phishing infrastructure.
URLs in the invitations appear to lead to a Google Forms page, but victims are eventually prompted to sign in with Google. The sign-in page is an adversary-in-the-middle proxy that relays credentials and authentication challenges to the real Google service, allowing account takeover while the victim remains unaware. The phishing panel supports Simplified Chinese, Traditional Chinese, and English locales, indicating the campaign is aimed at Chinese-speaking users.