Block UAT-11985 AI-Phishing Lures Targeting Taiwan Research Staff

Cisco Talos researchers identified a spear-phishing campaign targeting individuals affiliated with Taiwan research organizations. The threat actor, tracked as UAT-11985, uses an adversary-in-the-middle framework to capture Google account credentials and multi-factor authentication codes. The operation began in mid-2026 and relies heavily on artificial intelligence to generate bespoke lures. This automation allows the group to produce varied content quickly while maintaining a consistent social engineering structure. Defenders should note that the attack surface extends beyond email to include printed materials.

The risk

The primary risk involves credential theft through sophisticated deception. Cisco Talos researcher Joey Chen noted that the operation leverages legitimate public event themes to establish credibility. The emails contain hyperlinks that display legitimate-looking Google Forms URLs when hovered over, but actually direct users to attacker-controlled infrastructure. This technique bypasses basic visual inspection of links. Additionally, the actor modifies legitimate event posters with malicious QR codes. This quishing approach targets secondary victims who encounter printed materials, expanding the reach beyond the original email recipients.

Who is exposed

Individuals affiliated with Taiwan research organizations are the primary targets. The threat actor fabricates sender identities to impersonate reputable academic and policy institutions. Specific entities impersonated include the Taiwan European Union Centre, the NCCU Institute of International Relations, and the Taiwan Research Institute. The campaign uses a three-part email structure: a polished description of geopolitical context, a flattering section tailored to the recipient, and event logistics. This template indicates mass production from reusable prompts rather than individual crafting.

Cost and compliance

The source material does not specify financial costs or regulatory compliance impacts associated with this campaign. No data breaches or specific victim counts were reported in the Cisco Talos analysis. The focus remains on the technical methods used to harvest credentials and the scope of the impersonation.

Our take on the response

Organizations should treat all external event invitations as suspicious until verified through out-of-band channels. The use of AI-generated content means textual analysis alone may not reveal the fraud. Teams must prioritize monitoring for QR code usage in official communications and ensure that link inspection tools are configured to reveal true destination URLs.

What defenders should look for

Security teams should monitor for unusual login attempts from new geographies or devices following email engagement. Look for authentication failures followed by successful logins, which may indicate MFA code interception. Check web proxy logs for connections to newly registered domains that mimic legitimate services. Inspect email headers for discrepancies between the display name and the actual sender address. Review QR code scanning activity on corporate devices if such logging is enabled. Isolate compromised accounts immediately and force password resets.

Background: Threat actors

Small businesses must treat threat actors as automated scripts rather than targeted spies. Focus on patching, least privilege, and monitoring. Ask your IT provider about specific detection rules and incident response plans to reduce mean time to detect and limit damage during an intrusion.

Read the full guide: Threat Actors: Practical Defense Strategies for Small Businesses

What to do and how to stay safe: UAT-11985

• Verify the authenticity of event invitations by contacting the organizer through known, trusted contact methods.
• Disable automatic QR code processing on corporate devices and require manual scanning review.
• Configure email security tools to reveal the true destination URL of hyperlinks instead of the displayed text.
• Monitor for multiple failed MFA attempts followed by a successful login from the same source.

Step-by-step guide: Multi-Factor Authentication Fatigue: Why Users Click Yes Too Fast

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is UAT-11985?

UAT-11985 is an advanced persistent threat group tracked by Cisco Talos, known for using AI-assisted phishing to target Taiwan research affiliates.

How do the attackers harvest credentials?

They use an adversary-in-the-middle phishing framework that captures both Google account passwords and multi-factor authentication codes.

What institutions are being impersonated?

The attackers impersonate the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute.