Cisco Talos has published research on a spear-phishing campaign it tracks as UAT-11985, aimed at people affiliated with Taiwanese research organisations. The lures are event invitations. What sits behind them is an adversary-in-the-middle kit that takes an authenticated Google session while the victim watches it work.

How the kit defeats multi-factor authentication

It does not break MFA. It stands in the middle of it.

The victim lands on a page impersonating Google's sign-in, served in Simplified Chinese, Traditional Chinese or English, with its client-side JavaScript obfuscated by string rotation and control-flow tricks.

The kit runs two channels at once. HTTP POST carries one-shot exfiltration — browser fingerprints, the submitted credentials, challenge responses, periodic heartbeats. A WebSocket holds a persistent, low-latency connection over which the operator's server streams state updates that decide which screen the victim sees next.

Behind the page, the operator's server forwards the identifier and password to the real Google, and relays Google's answers back — including the type of MFA challenge issued, and whether a passkey is available. The victim completes the challenge they were always going to complete. The kit harvests the authenticated session token that results.

Talos describes this as effectively bypassing MFA to take complete session tokens, enabling full account takeover.

The practical consequence is the one people get wrong. A password reset does not help, because the attacker never needed the password after the first second. A session token is the thing to revoke, and most people do not know where that control is.

The posters

Several lures carried attached event posters. The designs were lifted from legitimate sites. The QR codes on them were replaced.

Talos makes a point about the posters that is easy to skip: a poster is printed. A recipient who finds the invitation plausible may pin it to an office noticeboard, and then the attack reaches everyone who walks past and scans it — people who were never emailed, never evaluated the sender, and have no reason to think a poster on a wall is a phishing vector.

That is a delivery mechanism that outlives the email and escapes the mailbox entirely.

What Talos actually says about AI

The campaign is being reported as AI-assisted. Talos's own wording is more careful, and the difference is worth keeping.

Its basis is structural: three invitation emails sharing a near-identical three-part structure, repeated jargon, interchangeable flattery, and fast customisation across different geopolitical topics — which reads as a reusable template.

Its hedge is explicit. Talos says it "cannot conclusively determine whether the emails were fully generated by a large language model", and that linguistic indicators alone cannot prove generative AI was used.

So the finding is a strong inference from writing style, not an observation of a tool. We made the same distinction about an agentic pentest tool last week: what gets reported as "AI did this" is usually "this looks like how AI writes", and those are different claims with different evidential weight.

Attribution, at the resolution Talos gives it

Talos calls this an advanced persistent threat campaign and names no country and no group.

The only language-based assessment in the post is narrower than the headlines suggest, and it is not about the operator. Talos says it assesses with moderate confidence that the phishing kit's developer is probably a Simplified Chinese speaker.

A kit's author and a kit's user are not the same person. Phishing kits are built, sold and rented. An assessment about who wrote the code is not an assessment about who sent the emails, and the post does not make the second one.

The impersonated organisations were the Taiwan European Union Centre, the NCCU Institute of International Relations and the Taiwan Research Institute. Recipients who contacted them could not confirm the senders worked there, which is how the fabrication was established.

One more number worth holding: Talos analysed three emails in detail, and gives no total for the campaign.

What to do

  • Move the people who matter to phishing-resistant authentication. A relayed challenge is defeated by a credential bound to the origin, and by very little else.
  • When an account is suspected, revoke sessions before resetting the password. The token is the asset.
  • Verify event invitations through a channel other than the invitation — a published address, a known contact, the organisation's own site.
  • Treat QR codes on printed material as untrusted links, because that is what they are, and tell the people who pin things to noticeboards.
  • Talos published ClamAV and Snort coverage and indicators in its public repository.

What is not established

  • The size of the campaign. Three emails were analysed in detail; no total is given.
  • Who is behind it. Talos names no actor and no country.
  • Whether a large language model wrote the lures. Talos explicitly declines to conclude it.
  • Whether the kit is bespoke or rented, which bears directly on how much the developer assessment says about the operator.
  • Whether any accounts were actually taken, as distinct from being targeted.