Taiwan Research Affiliates Targeted by UAT-11985

What happened

UAT-11985, a threat actor, has been targeting Taiwan research affiliates with fake event invites and Google AitM phishing, as reported by The Hacker News. The campaign, which was first observed in mid-2026, uses AI-assisted content generation to create fake event invites that appear to be from legitimate academic institutions, such as the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute.

According to Cisco Talos researcher Joey Chen, "The operation leveraged legitimate public event themes" to trick victims into providing their Google account credentials and multi-factor authentication codes. The threat actor uses QR code phishing techniques, modifies legitimate event posters, and creates fake Google Forms URLs to capture credentials and authentication challenges.

The phishing campaign is highly sophisticated, using obfuscated JavaScript and gathering device and browser information to evade detection. The threat actor also fabricates sender identities and uses a reusable prompt template to create fake event invites that appear legitimate.

Context

The use of fake event invites and Google AitM phishing by UAT-11985 is a newly documented tactic, according to The Hacker News. The threat actor's ability to impersonate academic institutions and use AI-assisted content generation to create fake event invites makes it difficult for victims to distinguish between legitimate and fake emails.

Joey Chen describes the operation as going further than ordinary email phishing, which shows how these attacks keep changing. The use of coordinated spear-phishing campaigns and the ability to capture credentials and authentication challenges make this threat particularly dangerous.

The fact that the campaign was first observed in mid-2026 suggests that UAT-11985 is a relatively new threat actor, but one that is quickly evolving and adapting its tactics to evade detection.

Why it matters

The targeting of Taiwan research affiliates by UAT-11985 matters to American universities, think tanks and companies that work with Taiwan-based researchers, because the same lure can reach their staff. Fake event invites paired with Google AitM phishing show that polished, AI-written lures can now look as convincing as real academic invitations.

The fact that the threat actor is able to impersonate academic institutions and use legitimate public event themes to trick victims into providing their credentials and authentication codes means people should treat unexpected invitations with caution, even when they appear to come from a familiar institution.

The campaign also highlights the importance of implementing robust security measures, such as multi-factor authentication and regular software updates, to prevent phishing attacks and protect sensitive information.

What you can do now

To protect yourself from phishing attacks like those used by UAT-11985, treat unexpected invitations carefully, even from organizations you know. Here are some steps you can take:

• Verify the authenticity of emails and invites by checking the sender's identity and looking for spelling and grammar mistakes.
• Avoid clicking on links or providing credentials and authentication codes to unknown sources.
• Use robust security measures, such as multi-factor authentication and regular software updates, to protect sensitive information.
• Be aware of the use of AI-assisted content generation and coordinated spear-phishing campaigns, and be cautious of emails or invites that appear too good (or bad) to be true.

What we don't know yet

While the campaign by UAT-11985 has been reported, there are still many unknowns about the threat actor and its motivations. It is unclear what the ultimate goal of the campaign is, or what the threat actor plans to do with the captured credentials and authentication codes.

Further research is needed to understand the full scope of the campaign and the tactics used by UAT-11985. Cisco Talos has not said how many people were targeted or whether any accounts were taken over.

According to Joey Chen, the attackers split what would normally be a single upload into separate pieces, a step that helps them avoid detection and keep the campaign running. Organizations that work with Taiwan-focused research groups should expect more attempts like this and review how staff verify event invitations.

Sources

• The Hacker News: UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing

Related on IntechPulse

• More Cybersecurity news
• Latest tech news on IntechPulse
• More on phishing