Cybersecurity researchers have uncovered details of an advanced persistent threat (APT) spear-phishing campaign specifically targeting individuals affiliated with Taiwan research organizations. The campaign directs victims to a sophisticated adversary-in-the-middle (AitM) phishing framework designed to harvest their **Google** account credentials and multi-factor authentication (MFA) codes. **Cisco Talos** is tracking this activity under the moniker **UAT-11985**. Researchers suggest the campaign likely benefits from artificial intelligence (AI)-assisted content generation, enabling the rapid creation of tailored lures within a consistent social engineering framework. The campaign was initially observed in mid-2023. "The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility," stated **Talos** researcher Joey Chen in an analysis. Beyond traditional email phishing, the threat actor has incorporated QR code phishing (quishing) techniques. This involves modifying legitimate event posters with malicious QR codes, thereby expanding the attack surface beyond email recipients to secondary victims who might encounter printed materials.  ### The Anatomy of a Spear-Phishing Lure Central to the operation is the use of legitimate or plausible public event information embedded in spear-phishing emails. These emails contain a URL pointing to attacker-controlled infrastructure, though hovering over the hyperlink displays a legitimate-looking **Google Forms** URL. These invitation emails exhibit remarkably similar syntactic structures despite covering a broad range of geopolitical topics. This uniformity suggests the content was mass-produced from a reusable prompt template, rather than painstakingly crafted for each individual target. Specifically, the emails adhere to a three-part structure: * The opening section provides a "polished (but overly elaborate) description" of the geopolitical or policy context. * The second section is tailored to the recipient, employing flattering language to encourage engagement. * The third and final section details event logistics, including topic, date, venue, and registration instructions. The threat actor has been observed impersonating legitimate Taiwan-based institutions such as the **Taiwan European Union Centre**, **NCCU Institute of International Relations**, and **Taiwan Research Institute**. Fabricated sender identities make the messages appear more convincing. "Taken together, the reuse of an almost-identical narrative structure, rhetorical style, personalized flattery, institutional impersonation, and deceptive registration mechanism strongly suggests a coordinated and carefully targeted spear-phishing campaign rather than three independent invitations," **Talos** noted. ### Quishing and the AitM Framework In some instances, the phishing emails incorporate legitimate event posters scraped from authentic websites. However, the QR codes on these posters are modified to trick victims into scanning a malicious QR code to "register" for the event.  The phishing site itself mimics the appearance of a legitimate **Google Form**. Its primary goal is to present a pop-up prompting the victim to sign in with their **Google** account to complete the form. This action redirects them to a bogus site featuring a spoofed **Google** login panel, designed to capture their credentials and authentication challenges. This pixel-perfect replica site functions as an adversary-in-the-middle (AitM) proxy. It utilizes obfuscated JavaScript to gather and exfiltrate entered information in real-time over a **WebSocket** connection, simultaneously forwarding it to legitimate **Google** authentication servers. Prior to establishing the **WebSocket** connection, the JavaScript payload collects device and browser information, including locale, user agent, screen dimensions, and mobile-device status. This data is then reported to the command-and-control (C2) server via a "google_login_start" request. When the victim submits their password, the phishing page transmits it, along with the account identifier and browser user-agent information, to the actor's HTTP C2 server through a "google_login_check" request. The threat actor's server, positioned in an AitM role, then forwards these credentials to the actual **Google** authentication service. "The spoofed **Google** login panels only support Simplified Chinese (zh-CN), Traditional Chinese (zh-TW), and English locales, with region detection based on the victim's browser 'navigator.languages,' strongly suggesting targeting of Chinese-speaking users," Chen explained. By deliberately splitting one-shot uploads with **POST** requests from low-latency state updates with **WebSocket** connections, the threat actor has engineered a seamless credential-harvesting relay. This sophisticated approach allows the threat actor to mirror **Google's** dynamic authentication state in real-time, ultimately achieving full account takeover without arousing the victim's suspicion.