Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

UAT-11985: Fake Event Invites Hijack Google Accounts of Taiwan Researchers via AitM Phishing

An AI-assisted spear-phishing campaign uses fake policy-event invitations and doctored QR codes to relay Google passwords and MFA codes in real time, then take over the victim's live session.

4T4Tify Team4Tify
Oct 17, 2026·5 min read
UAT-11985: Fake Event Invites Hijack Google Accounts of Taiwan Researchers via AitM Phishing

Fake conference invites, real Google account takeover: inside UAT-11985

A spear-phishing operation aimed at people connected to Taiwanese research and policy institutions is using convincing event invitations to steal Google credentials and the MFA codes that should protect them. Cisco Talos tracks the actor as UAT-11985 and assesses that it is an APT that likely uses AI to generate its lures at scale. The campaign was first seen in mid-2026.

What happened

The lure is an invitation to a plausible policy or academic event: a forum, a roundtable, a briefing. The emails follow a fixed three-part template:

  • a long, polished description of the geopolitical or policy background;
  • a personalised section that flatters the recipient;
  • event logistics (topic, date, venue) and a "registration" link.

The sender identities impersonate real Taiwan-based institutions, including the Taiwan European Union Centre, the NCCU Institute of International Relations and the Taiwan Research Institute. Talos noticed that messages on very different topics share almost identical structure and phrasing. That points to one reusable prompt template rather than hand-written emails, which lets the operator produce many tailored lures quickly.

In some cases the attacker took genuine event posters and swapped in a malicious QR code. That carries the attack beyond the inbox to anyone who sees a printed or forwarded copy of the poster.

How the account takeover works

The registration link looks like a Google Forms URL when you hover over it, but it actually leads to attacker infrastructure. The page imitates a Google Form and then shows a "sign in with Google to continue" pop-up. That pop-up is an adversary-in-the-middle (AitM) proxy:

  1. Obfuscated JavaScript fingerprints the browser (locale, user agent, screen size, mobile or not) and opens a session with the attacker's server.
  2. Each identifier, password and challenge response the victim types is relayed live to the real Google sign-in service. HTTP requests carry the data and a WebSocket channel keeps the fake page in sync with Google's real login state.
  3. Google asks for MFA, and the operator picks which challenge to show: SMS code, TOTP, a phone prompt, a backup code, a passkey or a recovery email.
  4. Once the victim completes the challenge, Google issues a session cookie to the attacker. The victim sees an "account connected" page and assumes everything worked.

The fake login panels only support Simplified Chinese, Traditional Chinese and English, and they pick a language from the browser settings. This fits the targeting of Chinese-speaking users. Talos has not publicly attributed the activity to a specific state, and we are not attributing it either.

Why it matters

  • One-time codes don't stop AitM. SMS, TOTP and push approvals are all relayed in real time, so the attacker ends up holding a valid session, not just a password.
  • AI-generated lures reduce the warning signs. Tailored, well-written invitations with no spelling mistakes remove many of the clues people are trained to spot.
  • QR codes get around email defences. A code on a poster or PDF skips link scanning and usually gets opened on a phone, where it's harder to inspect the URL.
  • Research, think-tank and academic staff are high-value targets. Their mailboxes and drives hold contacts, drafts and policy discussions that are worth collecting for espionage.

What to do

  1. Move high-risk users to phishing-resistant MFA. FIDO2 security keys or passkeys are bound to the real domain and can't be relayed by an AitM proxy. For Google Workspace, consider the Advanced Protection Program for executives, researchers and anyone who handles external relations.
  2. Treat unexpected sign-in prompts inside forms as a red flag. A real Google Form rarely needs you to sign in again through a pop-up. Close it and go to the organiser's official site directly.
  3. Verify invitations out-of-band. Confirm events with the named institution through a contact you already know, not the details in the email.
  4. Don't scan QR codes on event material without checking them. Preview the URL before opening it, and register through the organiser's official website.
  5. Hunt for session hijacking. In Workspace, review sign-in logs for new sessions from unusual IPs or ASNs right after a successful MFA, unfamiliar device or user-agent combinations, and new OAuth grants or mail-forwarding rules.
  6. Tighten session controls. Shorten session lifetimes for sensitive roles, enforce context-aware access, and revoke all sessions and reset credentials for any account that interacted with a suspicious form.
  7. Update awareness training. Include AI-polished invitations and "Sign in with Google to continue" form lures in phishing simulations.

Based on research published by Cisco Talos and reported by The Hacker News (16 Oct 2026). Summary and analysis by the 4Tify Team.

SHARE