# QR‑Code Phishing Campaign UAT‑11985 Targets Taiwan Research Accounts

*Friday, October 16, 2026 at 6:07 PM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-10-16T18:07:38.228Z (1h ago)
**Category**: cyber | **Region**: Southeast Asia
**Importance**: 7/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/20731.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: A threat group tracked as UAT‑11985 is sending fake event invitations with tampered QR codes to Taiwan research affiliates, luring them to spoofed Google sign‑in pages that intercept passwords and MFA codes in real time using adversary‑in‑the‑middle phishing.

Researchers and analysts linked to Taiwan’s institutions are being singled out by a phishing campaign that abuses QR codes to steal cloud credentials.

Reporting from The Hacker News describes a threat cluster tracked as UAT‑11985. The group is targeting Taiwan research affiliates with bogus event invitations that include QR codes. Recipients are encouraged to scan the codes to respond to the invitations or to view supposed event details.

Those QR codes lead to spoofed Google login pages. Behind the scenes, UAT‑11985 is using an adversary‑in‑the‑middle (AiTM) phishing setup that intercepts passwords and multi‑factor authentication (MFA) data in real time. When a victim enters their credentials and MFA code, the attacker’s infrastructure captures the session and can hijack access to the account.

The focus on people connected to research work in Taiwan suggests an interest in accounts that sit close to academic projects, policy discussions, and potentially sensitive data. Access to a single compromised Google account can expose email, documents, and calendars tied to institutional work.

For targeted users, the attack may look like a standard conference or workshop invitation. QR codes can feel less risky than clicking on a suspicious link, especially when they arrive in what appears to be a professional context. That makes this technique an efficient way to bypass some users’ usual caution.

Defenders in Taiwan’s research and policy community now face the challenge of warning staff and partners about QR‑based phishing while keeping genuine collaboration and events running smoothly. Technical counter‑measures, such as stronger phishing‑resistant authentication, may take time to roll out.

Indicators to watch include any formal advisories from Taiwanese authorities naming UAT‑11985, signs that similar QR‑based AiTM techniques are being used beyond Taiwan, and further technical details that could link this cluster to a known threat group.