Verify Event Invites to Stop UAT-11985 Credential Theft

UAT-11985, an advanced persistent threat group, gains access to Google accounts by stealing credentials and multi-factor authentication codes from researchers in Taiwan. To achieve this, the attackers need victims to trust fake event invitations that appear to come from legitimate academic or policy institutions. This trust allows the threat actors to redirect users to malicious infrastructure designed to capture login details in real time.

According to Cisco Talos, the campaign began in mid-2026 and relies heavily on artificial intelligence to generate bespoke lures quickly. The group impersonates reputable organizations such as the Taiwan European Union Centre and the NCCU Institute of International Relations. By fabricating sender identities and using plausible public event themes, the attackers establish credibility before directing victims to an adversary-in-the-middle phishing framework.

Attack Mechanics and Content

The spear-phishing emails follow a rigid three-part structure that indicates mass production from reusable prompt templates rather than individual crafting. The opening section provides an overly elaborate description of geopolitical or policy contexts to set a professional tone. The second section flatters the recipient to trigger engagement, while the final section details event logistics including topics, dates, and registration instructions. This syntactic consistency across diverse topics signals automated content generation.

Beyond email, the operation incorporates QR code phishing techniques by modifying legitimate event posters with malicious codes. This expands the attack surface beyond email recipients to secondary victims who encounter printed materials. When users hover over hyperlinks in the emails, the display shows a legitimate-looking Google Forms URL, masking the true destination which points to attacker-controlled infrastructure.

Who Is Targeted

The campaign specifically targets individuals affiliated with Taiwan research organizations. Cisco Talos researcher Joey Chen noted that the operation leverages legitimate public event themes to impersonate reputable academic and policy institutions. Specific entities impersonated include the Taiwan European Union Centre, the NCCU Institute of International Relations, and the Taiwan Research Institute. The focus on these groups suggests an intent to compromise accounts within the academic and policy sectors of Taiwan.

What to watch

Monitor incoming emails for overly elaborate descriptions of geopolitical contexts that do not match your current work priorities. Check for inconsistencies in sender identities, especially when the message claims to be from a well-known institution but contains generic flattering language. Be cautious of QR codes on printed materials or digital posters, as these may redirect to malicious sites even if the surrounding content appears legitimate.

What made it possible

This intrusion succeeds because victims trust the visual authority of institutional branding and event logistics. Teams usually rely on sender names and URL previews to verify legitimacy, but AI-generated content can mimic professional tone and structure perfectly. The weakness lies in the assumption that complex, well-written invitations are inherently safe. Attackers exploit this by creating plausible scenarios that bypass initial skepticism, allowing them to intercept credentials during the authentication phase.

Background: Multi-factor authentication

Implement multi-factor authentication by requiring a second verification step beyond the password. Use smartphone apps or hardware tokens for critical accounts. This stops attackers who steal credentials through phishing or data leaks. Configure it immediately on email, banking, and cloud services to secure your digital assets.

Read the full guide: Multi-Factor Authentication Setup for Small Teams

What to do and how to stay safe: UAT-11985

• Verify event invitations through independent channels by contacting the organizer using known phone numbers or official websites, not links in the email.
• Inspect hyperlinks carefully by hovering over them to view the actual destination URL, ignoring the display text which may be spoofed to look like a trusted service.
• Avoid scanning QR codes from unsolicited printed materials or emails, as these can redirect to adversary-controlled sites without revealing the target address.
• Enable additional account security measures such as hardware security keys, which are resistant to the credential harvesting techniques used in this campaign.

Step-by-step guide: Account Takeover: How Attackers Bypass Login Security

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is UAT-11985?

UAT-11985 is an advanced persistent threat group tracked by Cisco Talos that conducts spear-phishing campaigns using AI-generated content to target researchers.

How do the attackers steal credentials?

They use an adversary-in-the-middle phishing framework to harvest Google account credentials and multi-factor authentication codes from victims who click malicious links.

Who are the primary targets?

The campaign targets individuals affiliated with Taiwan research organizations, impersonating institutions like the Taiwan European Union Centre and NCCU Institute of International Relations.