UAT-11985 Deploys Templated AitM Proxies Against Taiwan Researchers via Modified Event QR Codes

The campaign centered on three-part emails that opened with geopolitical context, added personalized flattery, and closed with logistics pointing to attacker infrastructure. Hovering links displayed legitimate Google Forms URLs while QR codes on modified posters routed secondary victims to the same AitM framework. Device fingerprinting via locale, user-agent, and screen data preceded WebSocket exfiltration of passwords and challenges in real time. Evidence shows syntactic uniformity across lures despite varied topics, consistent with mass generation from a single prompt rather than manual crafting. Impersonation of NCCU Institute of International Relations and Taiwan European Union Centre relied on public event data scraped from legitimate sites. No independent technical attribution links the infrastructure to a specific state, though targeting patterns align with prior operations against Taiwan policy networks. Related campaigns documented by Mandiant in 2025 used similar AitM JavaScript for Google sessions but lacked the quishing vector. The reuse of public event themes expands reach beyond email to physical posters, increasing secondary exposure. FortiOS-tagged session bypass techniques observed in parallel operations suggest the actor may layer network-level evasion if initial phishing succeeds. Next indicators will likely include expanded QR distribution at academic venues and incremental changes to the WebSocket payload to evade detection signatures. Monitoring for new domains mimicking Taiwan EU Centre registration pages provides the earliest signal.