Cisco Talos Reports Suspected Use of AI by Chinese Hacker Group UAT-11985 in Phishing Campaigns Targeting Taiwan Research Institutions

Cisco's threat intelligence team Talos identified advanced persistent threat (APT) spear-phishing campaigns specifically targeting Taiwan research institutions in mid-2026. The attackers, identified as Chinese hacker group UAT-11985, deployed an advanced Adversary-in-the-Middle (AiTM) phishing framework simulating Google authentication pages to steal credentials and bypass multi-factor verification.

Talos noted that these phishing emails were sent under the names of institutions such as the 'Taiwan EU Center', 'Center for International Relations Studies at National Chengchi University', and 'Taiwan Thinktank'. The content first established a professional image with lengthy geopolitical and policy analysis, then added personalized compliments, exclusive invitations, or VIP seat offers for recipients. Due to the similar sentence patterns across different emails and the ability to rapidly replace event themes and recipient information, Talos inferred that UAT-11985 may have used AI to assist in generating related phishing content.

Technically, victims clicking the links would see a webpage mimicking a Google form, followed by a forged Google login interface. The tool transmitted account, password, and verification data via HTTP POST and maintained real-time connections using WebSocket, allowing attackers to dynamically switch between password input, passkeys, and multi-factor verification screens according to Google's actual verification status.