Cybersecurity
Talos tracks Google phishing against Taiwan researchers
Cisco Talos said it had tracked UAT-11985, a spear-phishing campaign aimed at people linked to Taiwan research organisations that used fake event invitations and a Google login proxy to collect credentials.
- Cisco Talos said it had tracked the campaign as UAT-11985, and said it first observed it in mid-2026.
- Talos said the actor sent fake event invitations and, in some cases, altered real event posters with malicious QR codes.
- The messages impersonated Taiwan European Union Centre, NCCU Institute of International Relations and Taiwan Research Institute, according to Talos.
- Talos said the phishing pages imitated Google Forms, then sent victims to a fake Google sign-in page that captured credentials and authentication prompts.
- Chen said the login pages supported Simplified Chinese, Traditional Chinese and English, using browser-language checks to focus on Chinese-speaking users.
Talos said it had linked the activity to UAT-11985 after seeing it in mid-2026. Chen said the group used public event themes and copied academic and policy bodies to gain trust, and Talos said the writing appeared to come from a reusable prompt.
Talos said the invitations followed the same three-part pattern: a policy introduction, flattery aimed at the recipient, and event logistics. In some cases, it said, the actor reused posters taken from real sites and changed the QR code.
The links led to pages that copied Google Forms and then prompted a Google sign-in to finish registration. Talos said the page collected device details, passed them to its server, and relayed the entered information while forwarding the session to Google’s authentication service.
Chen said the fake login panels were limited to Simplified Chinese, Traditional Chinese and English. He said the setup used browser-language checks and real-time relaying to capture accounts without interrupting the process.
Named in this story
People
- Joey Chen
- said the operation used event themes and impersonation
Companies
- the account provider whose login flow was mimicked
Organisations
- Cisco Talos
- tracked the campaign and published the analysis
- Taiwan European Union Centre
- one of the institutions the emails impersonated
- NCCU Institute of International Relations
- one of the institutions the emails impersonated
- Taiwan Research Institute
- one of the institutions the emails impersonated
Products and systems
- UAT-11985
- Talos’s label for the campaign
- Google Forms
- the interface the phishing pages copied
Places
- Taiwan
- the location associated with the targeted research organisations
How the source tells it
The register was analytical but cautionary, with Talos’s own threat-intelligence language providing most of the drama.
- alarm threat-intelligence vocabulary and vivid descriptions of credential theft and account takeover
- speculation presented as fact the AI-assisted explanation was inferred from repeated wording and template-like structure