A credible invitation can carry the wrong destination
Cisco Talos has described UAT-11985, a spear-phishing campaign observed in mid-2026 against people affiliated with Taiwan research organizations. Attackers impersonated academic and policy institutions and incorporated authentic event details into invitations. Talos also found legitimate event posters with malicious QR codes substituted into them. The research was published October 8.
A live relay behind the sign-in page
The campaign used counterfeit Google sign-in pages and a combination of HTTP and WebSocket communications to relay authentication steps, including multifactor challenges. Talos assesses that the invitations likely used AI assistance, but says it cannot conclusively establish that a language model generated them. Its language analysis of the kit is also an assessment, not proof of a particular government sponsor. The report provides defensive signatures and indicators.
Verification needs a separate route
For universities, policy institutes and government-facing research teams, our assessment is that event verification belongs alongside account protection. An accurate venue, agenda or speaker biography can establish that an event exists without establishing who sent an invitation. Staff should be able to reach the institution through a previously known contact or a separately located official page. Conference administrators can help by maintaining a clear registration address and a route for reporting suspicious invitations. That process should be easy enough to use when an invitation arrives close to a registration deadline.
Extend the process beyond the inbox
Printed posters and forwarded attachments need ownership too. A department distributing event material should retain its original source and verify the destination before circulating a QR code. In an incident review, record which invitation was received, whether a sign-in occurred, and which account was involved; do not infer account compromise merely from receipt of the message. For MSPs supporting research organizations, agree in advance who can assess affected sessions and coordinate account recovery. The practical objective is a short, reliable verification step that works for a researcher away from a desk as well as an administrator reviewing email.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
