Cisco Talos: Chinese Hackers UAT-11985 Suspected of Using AI to Generate Phishing Emails Targeting Taiwan Research Institutions

Cisco's threat intelligence team Talos disclosed on October 19, 2026, a targeted spear-phishing campaign specifically aimed at research institutions in Taiwan. The activity is attributed to the Chinese hacking group UAT-11985, characterized by the use of suspected AI-generated content to create highly convincing social engineering lures, combined with Adversary-in-the-Middle (AiTM) techniques to steal authentication credentials.

Talos noted that UAT-11985 sent phishing emails impersonating organizations such as the 'Taiwan EU Center', the 'Center for International Relations Studies' at National Chengchi University, and the 'Taiwan Thinktank'. These emails share extremely similar structures and wording patterns: they first establish a professional image with lengthy geopolitical and policy analysis, then add personalized remarks like compliments, exclusive invitations, or VIP seats for recipients, and finally provide event time, location, and registration details. Due to the close similarity in sentence patterns across different emails and the ability to quickly swap out event themes and recipient information, Talos assesses that the attackers likely used AI-assisted generation for these phishing contents to achieve low-cost mass customization.

In terms of propagation methods, the attackers employed a hybrid 'digital + physical' strategy. Beyond email, UAT-11985 embedded poster images obtained from event websites into their phishing letters but maliciously tampered with the QR Codes on the posters to point to attacker-controlled servers. Talos believes the attackers clearly expected recipients to print these posters and display them on office bulletin boards, thereby spreading phishing links from personal inboxes to public physical spaces and significantly expanding the potential reach of victims.