Cisco Talos said it saw a targeted phishing campaign in mid-2026 against people tied to Taiwan research groups. Talos tracks it as UAT-11985. The emails posed as invitations from three Taiwan bodies: the Taiwan European Union Centre, NCCU's Institute of International Relations and the Taiwan Research Institute. The sign-up link looked like a Google Forms address but went to a fake Google sign-in page. The victim types a password, the attacker's server passes it to real Google, and Google asks for an MFA step. A live connection tells the fake page which prompt to show. The victim answers, and the attacker gets the signed-in session. Some emails carried posters with altered QR codes.
Talos said a recipient checked with the organizations, and none could vouch for the three senders. It said the emails share a template and likely had AI help, which it cannot prove. The sources do not say how many people were targeted or whether any accounts were taken over.
Analysis: a correct password plus a typed code fails when the attacker relays the sign-in live. Ask your security team which logins accept typed codes, how staff verify event invites, and how printed QR codes are handled.