UAT-11985 Uses AI-Written Lures and an AitM Phishing Kit Against Taiwan Researchers
Do Son 
Attack chain | Image: Cisco Talos
| At a glance | |
| Actor | UAT-11985 (tracked by Cisco Talos) |
| Activity | Spear-phishing, QR code phishing (quishing), and AitM credential theft |
| Targets | People affiliated with Taiwan research organizations |
| Scale | Not disclosed; Talos analyzed three lure emails |
| Status | No law-enforcement action reported |
| Source | Cisco Talos research report |
TL;DR
Cisco Talos found a spear-phishing campaign against people linked to Taiwan research groups in mid-2026. The actor, UAT-11985, sent fake event invitations that led to an AitM phishing kit built to steal Google logins and MFA codes. Talos also says the lures show strong signs of AI-assisted writing.
What happened
In mid-2026, researchers in Taiwan received invitations to policy forums and seminars. The emails used the names of real bodies, including the Taiwan European Union Centre, the NCCU Institute of International Relations, and Taiwan Research Institute. However, the senders did not exist. One recipient checked with the institutions, and none could confirm that the three senders worked there.
Many event details came from real public announcements. As a result, the invitations looked credible at first glance.
AI-assisted invitation lures
All three emails followed the same three-part layout. First came a grand description of a geopolitical topic. Next, the writer praised the recipient with stock flattery and offers of VIP seats. Finally, each email listed a date, a venue, and a registration link.
According to Cisco Talos research on UAT-11985, the messages show “nearly identical syntactic structures despite discussing different geopolitical topics.” Talos cannot prove that a large language model wrote them. Still, the researchers say the campaign “demonstrates strong evidence of AI-assisted content production and personalization.”
Hidden links and poisoned QR codes
The registration links looked like normal Google Forms addresses. In reality, the hidden link target pointed to a phishing site on a third-party platform. The actor also attached event posters copied from real websites. On those posters, the actor swapped the real QR code for a malicious one.
This quishing step reaches people beyond the inbox. For example, a recipient might print the poster for an office notice board. Colleagues who scan the code would then land on the same trap.
How the AitM phishing kit works
The fake form soon pushes visitors to a copy of the Google sign-in page. Behind it sits an AitM phishing kit that relays each step to Google’s real servers. In Talos’ words, the kit uses “a dual-channel architecture including HTTP POST and WebSocket.”
Over HTTP POST, the page sends browser details, the email address, the password, and any MFA code to the attacker’s server. Meanwhile, the WebSocket channel lets a human operator choose which MFA screen the victim sees next. The kit can display SMS code, authenticator app, backup code, phone prompt, and passkey screens. Once Google issues a session token, the operator receives a live session cookie. The victim, by contrast, sees a fake “Operation successful” page.
The JavaScript also hides behind heavy obfuscation. It stores its strings in a large Base64 array and shuffles them at runtime to slow down analysts.
Who is behind it
Talos tracks the actor as UAT-11985 and describes the operation as an APT campaign. So far, it has not tied the activity to a named state group. Instead, the researchers focus on the kit’s language clues.
With moderate confidence, Talos assesses that the interface was first written in Simplified Chinese. The base translation file uses Simplified Chinese, and the code treats it as the default. The text also uses mainland terms for words such as “account,” “computer,” and “email.” Traditional Chinese and English versions appear to derive from that base. In addition, the login panels support only those three languages.
These clues point to the developer’s working language. They do not prove who runs the campaign or who directs it.
Impact and scale
Talos has not shared victim numbers or confirmed any successful break-ins. The report covers three lure emails sent to people in Taiwan’s research community. Even so, the possible damage is serious. A stolen Google session can expose email, cloud files, and research contacts. Because the AitM phishing kit relays codes in real time, SMS and authenticator codes alone do not stop it.
How to stay protected
- Verify unexpected event invitations through the organizer’s official website or phone number.
- Hover over links before clicking, and check that the real address matches the text shown.
- Avoid scanning QR codes on forwarded or printed posters. Type the event address yourself instead.
- Use phishing-resistant MFA, such as hardware security keys. These check the real website domain, so relay pages struggle to reuse them.
- Confirm that the address bar shows accounts.google.com before entering a Google password.
- Review active sessions in your Google account and sign out any device you do not recognize.
- Security teams should block the lookalike domains seen in the report, including natrlyi[.]com and morelessty[.]com.
Overall, this Taiwan spear-phishing campaign shows how AI tools can help attackers scale personal lures. Meanwhile, the AitM phishing kit turns those lures into full account takeovers.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
