first report on UAT-11985 today, October 8, 2026, at 06:01.
The actor conducted targeted credential-theft operations against research organizations in Taiwan using tailored event invitations, malicious QR codes, and a real-time adversary-in-the-middle (AitM) phishing framework capable of intercepting Google authentication sessions. Cisco Talos Blog
1. Actor intelligence profile
Intelligence field Assessment
Actor designation UAT-11985
Tracking organization Cisco Talos
Known aliases None publicly established
First observed Mid-2026
Public disclosure October 8, 2026
Suspected nexus Chinese-language development indicators; country attribution unconfirmed
Motivation Credential theft and account takeover; possible intelligence collection
Target geography Taiwan
Target sectors Academic research, policy research, international relations
Primary tooling Custom Google authentication AitM phishing framework
Malware No conventional endpoint malware family identified in the report
Attribution confidence Moderate for Simplified Chinese development indicators; insufficient evidence for state sponsorship
Talos assessed with moderate confidence that the phishing kit\'s interface was originally developed in Simplified Chinese and subsequently adapted for Traditional Chinese and English. This supports a linguistic assessment but does not independently establish nationality or government sponsorship. Cisco Talos Blog
2. Attack methodology
UAT-11985 impersonated legitimate academic and policy institutions, including the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute.
The actor used legitimate event details to construct convincing invitations, then redirected recipients to malicious registration and authentication pages.
Talos documented several notable techniques: AI-assisted phishing content generation, malicious QR codes inserted into legitimate event posters, deceptive Google Forms pages, and credential interception through a real-time AitM authentication relay.
The phishing framework used HTTP POST requests to transmit captured information and persistent WebSocket connections to coordinate authentication challenges. This allowed the operator to relay passwords and MFA challenges and potentially capture authenticated sessions. Cisco Talos Blog
Source: Cisco Talos — Official UAT-11985 IOC Repository
No dedicated malicious IP addresses or file hashes were included in the published IOC file. These indicators should not be expanded through speculative infrastructure attribution.
4. Detection opportunities
Cisco Talos published detection coverage for the activity:
Detection system Signature or rule
ClamAV Html.Phishing.UAT11985-10060614-0
Snort 2 1:67198
Snort 3 7:31
Defensive monitoring should also examine suspicious Google authentication sessions, unexpected WebSocket communications from login pages, and authentication-related HTTP requests associated with the published domains. Cisco Talos Blog
5. Attribution assessment
Confirmed: UAT-11985 is a newly published Cisco Talos tracking designation. Its documented activity targeted Taiwan-based research organizations during mid-2026 and employed an operator-controlled Google authentication phishing framework.
Moderate confidence: The phishing kit was developed primarily in Simplified Chinese. Talos also considers AI-assisted production of the phishing invitations likely, but does not establish that every message was generated by an LLM.
Unconfirmed: The actor\'s nationality, organizational leadership, government sponsorship, and relationships with established Chinese APT organizations remain unknown. No reliable alias mapping has been established.
UAT-11985 should therefore remain a separate provisional actor record, rather than being merged into an existing China-nexus APT based solely on linguistic indicators or victimology. Cisco Talos Blog
Primary intelligence source
Cisco Talos — UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing, October 8, 2026
Watch disposition: NEW ACTOR DESIGNATION — QUALIFIES.
