Taiwan researchers hit by AI-polished phishing emails that steal Google logins in real time

Key points

• Cisco Talos disclosed on 8 October 2026 a spear-phishing campaign, tracked as UAT-11985, aimed at people working at Taiwan research organisations.
• Attackers impersonated real academic and policy institutions and likely used AI tools to tailor each invitation while reusing the same underlying script.
• Victims who clicked were sent to a fake Google login page that passed their password and multi-factor code to the real Google in real time, letting the attackers slip in behind them.
• The group also swapped QR codes on legitimate event posters for malicious ones, a tactic called quishing, so even someone reading a printed flyer could be caught.
• The phishing kit combined standard web traffic with a live WebSocket channel to keep the fake and real login sessions in sync.

Cisco Talos has gone public with a phishing operation that spent weeks picking off staff at Taiwanese research institutes, and the detail worth pausing on is how modern the toolkit was. The researchers track the group as UAT-11985 and published their findings on 8 October 2026. Two weeks earlier we'd reported on a nearly identical playbook run against U.S. AI policy experts, where fake login pages captured both passwords and the one-time codes meant to stop unauthorised access.

The targets here were academics and policy analysts at Taiwan research organisations: inboxes that routinely receive conference invitations.

That's exactly what the attackers sent.

How did the attack actually work?

The emails looked like invitations to real public events, signed in the name of well-known academic and policy institutions. Talos says the wording was so consistent across targets that the group almost certainly used AI writing tools to generate fresh lures quickly without losing the house style.

A victim who clicked landed on what looked like a normal Google sign-in. It wasn't. Behind it sat an adversary-in-the-middle proxy, a server between the victim and real Google that copies everything passing through. The victim typed their password; the proxy typed it into Google. Google asked for the multi-factor code; the proxy asked the victim, then handed Google the answer. Google, satisfied, issued a valid session, and the attackers kept it.

Talos describes the framework as a hybrid of ordinary HTTP requests and a WebSocket connection, a persistent two-way channel that kept the fake site and the real login flow in step second by second. That synchronisation is what makes this class of kit dangerous: the multi-factor prompt the victim approves is a genuine one from Google, triggered by the attacker's own login attempt.

What is quishing, and why does it matter here?

Quishing is phishing via QR code rather than a clickable link. UAT-11985 took legitimate event posters, replaced the real QR code with one pointing at their fake Google page, and let the altered posters do the work.

The attack no longer needs an email at all. Anyone who scanned a tampered poster in a corridor or at a venue could reach the credential-harvesting page, which is why Talos flags people encountering printed materials as part of the exposed group. We've covered quishing four times since first reporting the tactic on 17 July 2026, and physical-world deployment of this kind is the step that tends to catch security teams off guard.

What should ordinary readers take from this?

Two things are worth holding onto. Multi-factor authentication is still worth having, but the older sort where you type a six-digit code into a website can be relayed by a proxy like the one UAT-11985 built. Hardware security keys and passkeys, which are cryptographically tied to the real web address of the site, don't fall for this trick because they refuse to authenticate against a fake domain.

Also treat QR codes on posters and flyers the way you'd treat a link in an unexpected email. If the destination is a login page asking for credentials, close it and navigate to the service directly.

My read on UAT-11985: the AI-written lures are the headline, but the real shift is operational. A group running a live proxy against Google, keeping sessions synced over WebSocket and seeding physical venues with their own QR codes is treating a phishing campaign as a managed product. Expect this kit, or something close to it, to surface against other research and policy communities soon.