The Invitation Where Everything Checked Out

An invitation to a research seminar is about as ordinary as email gets. It names a real topic, a plausible venue and a date, and asks you to register. In a campaign Cisco Talos tracks as UAT-11985, that ordinariness was the weapon. The logistics were largely copied from genuine events, the registration page appeared to sit on Google Forms, and the sign-in page that followed relayed each step to the real Google. Nothing in the chain looked wrong to the eye, which is exactly why it is worth understanding.

What Cisco Talos found

In a Threat Spotlight published on 8 October 2026, Talos researcher Joey Chen describes a spear-phishing campaign it observed in mid-2026 against individuals affiliated with Taiwan-based research organisations. Three invitation emails impersonated the Taiwan European Union Centre, the NCCU Institute of International Relations and the Taiwan Research Institute.

The emails followed one template: a section of geopolitical context, some flattery aimed at the recipient, and then the event details. Talos says the logistics were largely lifted from real event announcements, a technique it calls "legitimacy laundering". When a recipient contacted the named organisations, none could confirm that the senders were their employees or representatives. That is the check worth copying.

Why the invitation reads as genuine

Most of us train ourselves to spot what is wrong in a message: a clumsy sentence, an odd sender, an unexpected attachment. Here, the parts that can be checked at a glance were true. The event existed in the form described, the venue and timings were borrowed from the real thing, and the subject matter suited the recipient's work.

Flattery and topical relevance are old social engineering tools, but they are cheap to produce well now. Talos found the three emails shared near-identical syntax and rhetoric across different topics, which it says suggests a reusable prompt template. It is careful to add that it "cannot conclusively determine" whether a large language model wrote them, and that linguistic clues alone cannot prove it. That caution is worth keeping. The practical point holds either way: a fluent, well-targeted invitation is no longer evidence of a legitimate sender.

The link that said one thing and did another

The registration link displayed what looked like a Google Forms address. The underlying destination was something else: a phishing site hosted on a third-party platform. Visitors saw a form designed to mimic Google Forms, and were then redirected to a spoofed Google sign-in page.

This is the oldest trick in phishing, a mismatch between the link text and the real target, and it keeps working because people read the text, not the destination. Hovering over a link (or long-pressing it on a phone) to see where it really points takes a few seconds and catches this one. It also helps to treat any "register to see the details" step as a reason to pause, because the details were already in the email.

Why the sign-in still works when MFA is switched on

The fake sign-in page is not a static copy. Talos describes an adversary-in-the-middle relay that shows the page in Simplified Chinese, Traditional Chinese or English, chosen from the browser's language settings. As the victim types, the kit passes each step on to the real Google services using plain HTTP requests, and uses a WebSocket to keep the fake page in step with what Google asks for next. The post names three request types: one that sends a browser fingerprint, one that sends the email address or phone number, and one that sends the password and user agent. The server also checks for passkey flows and returns whichever MFA challenge type the real service requests.

In plain terms, the victim is completing a genuine sign-in with an attacker standing in the middle of it. A code from an authenticator app or a text message is typed into the fake page and can be passed along, so the real challenge is satisfied. Talos describes the kit as "optimized for operator-driven authentication orchestration", meaning a person is steering it rather than a fully automated script. Our earlier piece on how adversary-in-the-middle phishing steals live sessions explains why the session, rather than the password, is usually the prize. This is a limit of some MFA methods, not a flaw in Google's service.

The poster problem

One detail goes beyond email. Talos found that event posters had been taken from legitimate websites and their QR codes altered to point at malicious destinations. It suggests recipients might print them, which would expose secondary victims who never received the email, for example someone walking past a noticeboard. A QR code cannot be read by eye, so the usual instinct to check the link has nothing to grip. We cover that blind spot in our guide to QR-code phishing.

The targets here were research staff in one region, and Talos does not assign the campaign to a particular state or country. It says, with moderate confidence, that the kit's interface was first written in Simplified Chinese and later adapted, which is a clue about the developers' working language and not a verdict on who is behind it. Our own observation is that the lure style transfers easily to any sector that runs conferences, webinars, alumni evenings or industry briefings.

What to do about it

None of this requires panic. It requires a few habits that work even when the message looks right.

• Verify the event through a route you already trust. Open the organiser's website by typing the address yourself, or phone a known number. If nobody there has heard of the invitation, you have your answer, as the recipient in the Talos case found.
• Check where a link really goes. Hover or long-press before you click. A Google Forms address that resolves elsewhere is a stop sign.
• Treat a sign-in page reached from an email as suspect. If a task needs you to sign in, go to the service directly rather than through the message.
• Be wary of QR codes on printed or forwarded material. Look at the address your phone previews before opening it, and prefer the organiser's own site.
• Prefer phishing-resistant sign-in where it is available. Passkeys and similar methods are bound to the genuine site's domain, so a relay on a look-alike address cannot complete them in the same way a typed code can be passed along. Ask your IT team whether these can be required for staff with access to sensitive data.
• Make reporting easy and fast. The person who contacted the named organisations did exactly the right thing. A one-click report button, and a quick response when someone uses it, turns that instinct into a team-wide signal. If someone thinks they signed in on a suspicious page, speed matters: reset the password, then sign out all sessions so a captured session stops working.

The bottom line

The Talos findings are a reminder that good security awareness is not a matter of spotting bad writing. The strongest defence is a habit of verifying through a second channel, backed by sign-in methods that do not depend on a person judging a page, and a culture where reporting a doubtful invitation is welcomed. People are a layer of defence worth equipping, and campaigns like this are won or lost on whether the person who felt uneasy had an easy way to say so.

Sources

Cisco Talos: UAT-11985, AI-assisted event lures delivering real-time Google AitM phishing (Joey Chen, 8 October 2026). General guidance: NCSC: Phishing attacks, dealing with suspicious messages.

Phishing Tackle offers the tools businesses need to strengthen their human risk strategies, with multi-platform testing, real-time behavioural insights, and actionable data to keep your organisation ahead of modern cyber threats.

Contact us today to learn how Phishing Tackle can help safeguard your organisation from the growing array of cyber risks.