cyber.hendryadrian.com
Threat Research · thehackernews.com

UAT-11985 Uses Fake Event Invitations and QR Codes to Steal Google Credentials

· Original article ↗

Summary

Cisco Talos says UAT-11985 targeted Taiwan research affiliates with fake event invitations and QR codes, using an AitM phishing proxy to capture Google credentials and MFA challenges.

Key points

  • Talos says the campaign, first observed in mid-2026, targeted people affiliated with Taiwan research organizations.
  • The lures impersonated Taiwan-based institutions and used public event themes; Talos says their similar structure suggests a reusable template and likely AI-assisted content generation.
  • Some emails included event posters with malicious QR codes, extending the phishing attempt beyond email recipients.
  • The phishing site imitated Google Forms and prompted victims to sign in through a spoofed Google login panel.
  • An AitM proxy reportedly captured credentials and authentication challenges, forwarding them to Google while relaying authentication state in real time over WebSocket.
  • The JavaScript collected device and browser details; Talos says the login panels supported Simplified Chinese, Traditional Chinese, and English.

Article Details

Attack Vectors
  • Spear-phishing emails used fabricated event invitations and institutional impersonation to direct targets to attacker-controlled phishing infrastructure.
  • Modified QR codes on event posters directed people who scanned them to the phishing site.
  • An adversary-in-the-middle phishing proxy imitated Google Forms and Google login panels to capture credentials and MFA codes.

MITRE ATT&CK

T1041 · Exfiltration Over C2 ChannelThe phishing site exfiltrated entered information to the actor's C2 server over HTTP and a WebSocket connection.T1056.003 · Web Portal CaptureThe spoofed Google login panel captured account credentials and authentication challenges.T1071.001 · Web ProtocolsThe phishing proxy used HTTP requests to communicate with its C2 server and relay submitted credentials.T1566.002 · Spearphishing LinkUAT-11985 sent spear-phishing emails with links to attacker-controlled credential-harvesting infrastructure.

People

Joey ChenCisco Talos researcher who discussed the campaign's targeting and phishing operation.

Threat Actors

UAT-11985Cisco Talos tracking name for the actor behind the phishing campaign targeting Taiwan research affiliates.

Products

Google formsto attacker-controlled infrastructure, while hovering over the hyperlink displays a legitimate-looking Google Forms URL.

Countries

Taiwanan advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed

Industries

Academic"The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility," Talos researcher Joey Chen said in an analysis.Policy"The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility," Talos researcher Joey Chen said in an analysis.Researchpersistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to

Related Articles