Cisco Talos Identifies WebSocket Phishing Kit Bypassing MFA for Taiwan Researchers

Cisco Talos researchers identified a sophisticated phishing operation targeting individuals affiliated with research organizations in Taiwan. The campaign, tracked as UAT-11985, employs a custom-built kit that uses live WebSocket connections to bypass multi-factor authentication by relaying login steps in real time.

What happened

According to Cyber Security News, the phishing kit guides victims through fake sign-in screens while an operator controls each stage of the authentication process. Unlike static credential harvesting forms, this system mirrors Google’s login flow using a combination of HTTP requests and WebSocket updates.

Researchers from Cisco Talos detailed the campaign in a threat research report published on October 8. The analysis, based on data gathered during mid-2026, describes an operator-driven system designed to steal authenticated sessions rather than just passwords.

The attackers sent emails posing as invitations to academic and policy events. These messages impersonated the Taiwan European Union Centre, NCCU Institute of International Relations, and Taiwan Research Institute, using real event details to enhance credibility.

When recipients verified the senders with the actual institutions, none could confirm the individuals were employees or representatives. The attackers used accurate event information to build trust around these fabricated identities.

Each email followed a consistent pattern featuring a policy-themed opening, tailored praise, and registration instructions. Talos noted signs of AI-assisted writing, including repeated sentence patterns and broad compliments, though they could not prove large language models wrote the complete emails.

Victims first encountered a fake Google Form that redirected them to a copied Google sign-in page. This setup places a convincing login page between the user and the real authentication service, similar to tactics seen in Tycoon 2FA phishing attacks.

Why it matters

The operation demonstrates how attackers can bypass MFA by forwarding login steps in real time rather than breaking security checks themselves. This approach allows operators to maintain control over the session as the victim completes authentication steps.

The campaign specifically targets people linked to research organizations in Taiwan. By using legitimate-looking event posters and replacing QR codes with malicious ones, attackers expand their reach beyond email recipients.

Talos suggested that printed posters could expose additional people who never received the original email. A familiar design therefore offers no assurance that its registration code leads to a safe destination.

Our take on the response

• The campaign relies on operator-driven control to manage authentication stages in real time.
• Attackers use accurate event details and impersonated institutional identities to deceive targets.
• AI-assisted writing helps tailor emails, though full automation was not confirmed by researchers.

Background: Multi-factor authentication

Deploy multi-factor authentication across all user accounts using phishing-resistant methods like FIDO2. Enforce strict policies for privileged accounts. Monitor for authentication anomalies. Combine MFA with conditional access rules to balance security and usability without creating excessive friction for legitimate users.

Read the full guide: Multi-Factor Authentication Best Practices for Secure Access

What to do and how to stay safe: Google

• Monitor logs for unusual WebSocket connections originating from user endpoints, particularly during login events.
• Verify event registrations and QR codes through official channels rather than clicking links in unsolicited emails.
• Train staff to recognize AI-generated phrasing and generic praise in professional correspondence.
• Ensure security awareness programs cover the risks of real-time proxy phishing kits that bypass MFA.

Step-by-step guide: Social Engineering Explained: How Manipulation Bypasses Security

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How does this phishing kit bypass multi-factor authentication?

The kit uses live WebSocket connections to relay authentication requests in real time, allowing an operator to guide the victim through each login step.

Who are the primary targets of this campaign?

The operation targets individuals linked to research organizations in Taiwan, including those associated with academic and policy events.

Did Cisco Talos confirm the use of large language models?

Talos noted signs of AI-assisted writing but could not prove that a large language model wrote the complete emails.