Actor Profile

UAT-11985 is an advanced persistent threat actor tracked by Cisco Talos, first observed in mid-2026. The actor demonstrates sophisticated social engineering capabilities, likely leveraging artificial intelligence-assisted content generation to rapidly craft bespoke phishing lures targeting individuals affiliated with Taiwan research organizations. The actor's motivation appears to be credential harvesting and account takeover of Google accounts belonging to Taiwan-based researchers and academics. The operation shows high technical sophistication through use of adversary-in-the-middle (AitM) phishing infrastructure, QR code phishing (quishing), and institutional impersonation. Language targeting (Simplified Chinese, Traditional Chinese, and English) strongly suggests focus on Chinese-speaking victims, particularly within Taiwan's academic and policy research sectors.

TTPs (Tactics, Techniques, Procedures)

The actor employs spear-phishing emails (T1566.002) with malicious links directing victims to AitM phishing infrastructure. Social engineering techniques include impersonation of legitimate Taiwan institutions (Taiwan European Union Centre, NCCU Institute of International Relations, Taiwan Research Institute) and fabrication of event invitations using AI-generated content following reusable prompt templates. QR code phishing (quishing) extends the attack surface by modifying legitimate event posters with malicious QR codes. The phishing framework uses obfuscated JavaScript to establish WebSocket connections for real-time credential exfiltration (T1056.003 - Web Portal Capture) while simultaneously proxying authentication to legitimate Google servers to bypass MFA. The infrastructure collects device fingerprinting data (locale, user agent, screen dimensions, mobile status) and transmits credentials via HTTP POST requests ("google_login_start", "google_login_check") to attacker-controlled C2 servers (T1071.001 - Application Layer Protocol: Web Protocols). The pixel-perfect Google login replica supports only zh-CN, zh-TW, and English locales, indicating targeted victim profiling.

Targets & Patterns

UAT-11985 specifically targets individuals affiliated with Taiwan research organizations, focusing on the academic and policy research sectors. Victims include researchers, academics, and policy professionals associated with Taiwan-based institutions. The targeting pattern suggests geopolitical intelligence collection objectives, with the actor exploiting Taiwan's active research community and their participation in academic conferences and policy events. The use of legitimate public event themes related to geopolitical and policy topics provides credible pretexts for engagement. The actor's impersonation of reputable academic institutions (NCCU Institute of International Relations, Taiwan European Union Centre, Taiwan Research Institute) demonstrates detailed reconnaissance of Taiwan's research ecosystem. The language support (Traditional Chinese, Simplified Chinese, English) and browser locale detection confirm deliberate targeting of Chinese-speaking users within Taiwan's research community. The quishing component extends targeting beyond primary email recipients to secondary victims who may encounter modified event posters in physical or digital formats.

Historical Context

UAT-11985 was first observed in mid-2026, representing a relatively recent campaign tracked by Cisco Talos. The campaign demonstrates evolution in phishing techniques through integration of AI-assisted content generation for mass production of personalized lures, marking a shift from traditional manual spear-phishing approaches. The incorporation of QR code phishing (quishing) alongside traditional email phishing represents an expansion of attack vectors. The operation's use of AitM phishing frameworks to bypass MFA aligns with broader industry trends observed in 2025-2026 where threat actors increasingly adopted real-time proxy techniques to defeat multi-factor authentication. No direct links to previously tracked APT groups or campaigns are mentioned in the available data, suggesting UAT-11985 may represent either a newly identified actor or an existing group employing novel TTPs that differentiate this activity cluster from prior operations.

Defensive Recommendations

  • Implement conditional access policies that restrict Google account sign-ins to trusted devices and known IP ranges, reducing effectiveness of AitM proxy attacks even when credentials are compromised
  • Deploy email security controls that detect and block emails with URL display text mismatches (where hover-over URLs differ from displayed text) and scrutinize emails impersonating academic institutions
  • Monitor for anomalous authentication patterns including sign-ins from unexpected geolocations, unusual user-agent strings, or WebSocket connections to non-Google domains during authentication flows (T1071.001)
  • Educate users on QR code phishing risks, advising verification of QR code sources on event materials and encouraging manual URL entry rather than scanning codes from untrusted sources
  • Enable phishing-resistant authentication methods such as FIDO2/WebAuthn hardware security keys that cannot be proxied by AitM frameworks, replacing SMS or app-based MFA for high-value research accounts

---

# Geopolitical Context

Geopolitical Context

The UAT-11985 campaign represents a sophisticated intelligence collection effort against Taiwan's research and academic community, exploiting the island's active participation in international policy discourse. The operation's focus on credential harvesting from Google accounts—widely used by academics for communication and collaboration—suggests an intent to establish persistent access to research networks and intellectual capital. The targeting of Taiwan-based institutions occurs amid heightened cross-strait tensions and reflects broader patterns of cyber operations aimed at the island's strategic sectors. The impersonation of legitimate academic bodies and use of geopolitical event themes as lures indicates operational awareness of the target community's professional interests and information-seeking behaviors.

State Actor Alignment

While Cisco Talos has not publicly attributed UAT-11985 to a specific state actor, several operational characteristics warrant attention. The phishing infrastructure's deliberate support for Simplified Chinese, Traditional Chinese, and English locales—with region detection targeting Chinese-speaking users—is consistent with operations conducted by or on behalf of actors with interest in Taiwan's research output. The campaign's sophistication, including AI-assisted content generation and adversary-in-the-middle proxy infrastructure, suggests resourcing beyond typical cybercriminal operations. The focus on credential theft rather than immediate financial gain aligns with intelligence collection objectives typically associated with state-sponsored or state-aligned threat actors operating in the Asia-Pacific region.

Business Impacty pro region

The campaign underscores persistent cyber threats to Taiwan's knowledge economy and academic freedom. Successful credential compromise could enable adversaries to access sensitive research data, monitor scholarly communications, and map institutional networks—capabilities with implications for Taiwan's technological competitiveness and national security. For the broader Asia-Pacific region, the operation demonstrates evolving tradecraft in targeting research communities that serve as nodes in international collaboration networks. European and North American institutions maintaining partnerships with Taiwan-based researchers may face secondary exposure if compromised accounts are leveraged for lateral movement or supply chain attacks. The use of AI-assisted content generation to scale personalized phishing represents a capability shift that may be replicated against research sectors globally, particularly in democracies with active China-focused policy research communities.

Forecast

If UAT-11985 continues operations with current tradecraft, Taiwan's academic and research sectors will likely face sustained credential theft attempts through mid-2027, particularly surrounding high-profile geopolitical events that provide plausible lure content. Should the campaign prove successful in establishing persistent access, follow-on activity may include lateral movement within institutional networks and targeting of international collaborators. If AI-assisted phishing content generation demonstrates operational efficiency, similar techniques are likely to be adopted by other threat actors targeting research communities in Japan, South Korea, and Western democracies engaged in Indo-Pacific policy discourse. Organizations that implement phishing-resistant multi-factor authentication (such as FIDO2/WebAuthn) and conduct targeted awareness training on AitM techniques may significantly reduce successful compromises, though the campaign's sophistication suggests adaptive responses from the threat actor are probable.