Cisco Talos: UAT-11985 Uses Live WebSocket Relays to Steal Google Sessions From Taiwan Academics

Cisco Talos researchers have detailed a sophisticated phishing operation that uses live WebSocket connections to steal Google account sessions. The campaign, tracked as UAT-11985, targets individuals associated with research organizations in Taiwan. According to Cyber Security News, the attackers guide victims through fake sign-in screens that mirror Google’s authentication process in real time, allowing them to bypass multi-factor authentication without breaking the underlying security checks.

In plain English

The attack relies on a man-in-the-middle technique that operates differently than traditional password theft. When a victim enters their credentials on the fake page, the system does not just save the password. Instead, it uses live connections to forward each step of the login process to the real Google service. This allows an operator to capture the authenticated session token. The method mirrors the risk seen in previous Tycoon 2FA phishing attacks, where a convincing login page sits between the user and the legitimate authentication service.

The background

Researchers identified the campaign during mid-2026 and published their findings in an October 8 threat report. The operation begins with emails that pose as invitations to academic and policy events. These messages impersonate the Taiwan European Union Centre, NCCU Institute of International Relations, and the Taiwan Research Institute. According to Talos, the emails followed a pattern of policy-themed openings and tailored praise. Analysts noted signs of AI-assisted writing, such as repeated sentence patterns and broad compliments, though they could not prove a large language model generated the complete content.

What changes now

The attackers enhanced their deception by copying legitimate event posters and replacing their QR codes with malicious ones. Talos suggested that printed posters could expose additional people who never received the original email. When recipients checked the supposed senders with those institutions, none could confirm the individuals were employees. Accurate event information helped the attackers build trust around fabricated identities. Each message contained hidden registration links that directed victims to a fake Google Form, which then redirected them to the copied sign-in page.

What to do and how to stay safe: Cisco Talos

• Verify sender identities directly through known phone numbers or official websites rather than replying to emails or clicking links.
• Inspect QR codes on printed materials by scanning them with a separate device or checking the URL preview before entering credentials.
• Monitor browser activity for unexpected redirects or login prompts that do not match the expected destination domain.
• Enable account alerts to receive immediate notification of sign-ins from new devices or unfamiliar locations.

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this attack break multi-factor authentication codes?

No, the kit bypasses MFA by relaying login steps in real time using WebSocket connections, rather than cracking the security checks.

Which organizations are being impersonated in these emails?

The attackers impersonated the Taiwan European Union Centre, NCCU Institute of International Relations, and the Taiwan Research Institute.

Is AI confirmed to have written the phishing emails?

Researchers found signs of AI assistance but could not prove that a large language model wrote the complete emails.