Phishing · Identity
Fake Event Invites Used in Advanced Phishing Attack Against Taiwan Researchers
Researchers report a phishing campaign targeting Taiwan research affiliates with fake event invites and Google login pages. The attack aims to steal account credentials and bypass multi-factor authentication.
Ross Grant3 min read
The short version
A group is sending fake event invitations to people connected with research organisations in Taiwan. The emails and posters look real and ask people to log in with their Google account. When victims do, the attackers steal their passwords and security codes, letting them take over the accounts. This attack uses advanced tricks to get past even multi-factor authentication.
What happened?
A phishing campaign has targeted individuals linked to Taiwan research organisations using fake event invitations. The attackers impersonated well-known institutions and used Google lookalike login pages to steal account credentials and multi-factor authentication codes. The campaign was first observed in mid-2026 and is tracked as UAT-11985, according to The Hacker News.
A New Phishing Campaign Targets Taiwan Research Affiliates
A recent report from Cisco Talos, covered by The Hacker News, describes a targeted phishing campaign against individuals linked to research organisations in Taiwan. The campaign, tracked as UAT-11985, began in mid-2026 and uses fake event invitations to trick victims into giving up their Google account credentials and multi-factor authentication (MFA) codes. The attackers impersonate well-known academic and policy institutions to make their emails look convincing. [The Hacker News (opens in a new tab)]
How the Attack Works
The phishing emails follow a three-part structure. First, they include a detailed description of a geopolitical or policy event. Next, the message flatters the recipient, making them feel personally selected. Finally, it provides event details and registration instructions. The attackers use real or plausible event information and often copy event posters from legitimate websites. In some cases, they alter the posters to include malicious QR codes. Victims who scan these codes or click on the links are directed to attacker-controlled websites that mimic Google Forms.
The phishing site prompts users to sign in with their Google account. When a victim enters their credentials, the site captures their username, password, and browser details. The attackers then use an adversary-in-the-middle (AitM) technique, relaying the credentials to Google in real time. This allows them to intercept not just passwords but also MFA codes, giving them full access to the victim’s account.
Who Is Behind the Attack?
The campaign is attributed to a group labelled UAT-11985 by Cisco Talos. The group appears to use artificial intelligence (AI) tools to generate large numbers of convincing phishing emails quickly. The emails are written in Simplified Chinese, Traditional Chinese, and English, suggesting the attackers are targeting Chinese-speaking users. The impersonated institutions include the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute.
What Makes This Attack Different?
Unlike typical phishing, this campaign uses several advanced tactics. The use of QR codes (sometimes called "quishing") means that even printed materials can be used to lure victims, not just emails. The phishing sites are designed to look exactly like Google’s own login pages, and the attackers use real-time relaying to bypass MFA protections. This makes the attack harder to spot and more dangerous for those targeted.
What Should You Do?
If you receive an unexpected event invitation, especially one that asks you to log in with your Google account or scan a QR code, be cautious. Check the sender’s email address and look for signs of impersonation. Do not enter your credentials on unfamiliar sites. If you think you may have fallen for such a scam, change your password immediately and review your account’s security settings. Organisations should train staff to recognise these tactics and consider technical defences such as phishing-resistant MFA.
What Is Still Unclear?
So far, only The Hacker News has reported on this campaign, citing Cisco Talos research. There are no public statements from Google or the affected institutions. The full scale of the attack and the number of victims are not yet known. Further confirmation from primary sources is needed before drawing broader conclusions.
Claimed vs confirmed
- Unconfirmed
Attackers used fake event invites and Google lookalike pages to steal credentials and MFA codes from Taiwan research affiliates.
Reported by The Hacker News citing Cisco Talos research; not yet confirmed by primary sources.
The impact
- Money
- No financial losses reported, but similar breaches can lead to costs from incident response and possible regulatory fines if personal data is compromised.
- Reputation
- The use of well-known institution names could damage trust in academic event communications, especially if more victims come forward.
- Customers
- Targets are individuals linked to research organisations. Anyone receiving similar event invites should be cautious and verify before entering credentials.
Why it matters
This attack targets people who may handle sensitive research or policy information. It shows that even multi-factor authentication can be bypassed with advanced phishing. Anyone who receives event invites or QR codes should be careful, as these tactics could be used against other groups in the future.
How does it work?
The attackers send emails or event posters with links or QR codes leading to fake Google Forms. Victims are prompted to log in, and their credentials and MFA codes are captured using an adversary-in-the-middle (AitM) technique, which relays login data in real time to bypass authentication protections.
Key points
- Phishing campaign targets Taiwan research affiliates with fake event invites.
- Attackers use Google lookalike pages to steal credentials and MFA codes.
- Emails and posters impersonate real academic institutions.
- QR codes expand the attack beyond email to printed materials.
- The campaign uses advanced techniques to bypass security protections.
Sources
The Hacker News
Reference
