Fake Conference Invites Used in Sophisticated Phishing Campaign Against Taiwan Researchers

Cybersecurity analysts have uncovered a coordinated spear‑phishing operation that leverages counterfeit event invitations to compromise individuals linked to Taiwanese research institutions. The campaign, identified as an advanced persistent threat (APT), directs recipients to an adversary‑in‑the‑middle (AitM) phishing framework that can intercept and harvest credentials in real time.

The lures take the form of professionally designed emails announcing seminars, workshops or symposiums relevant to scientific fields. Embedded links lead victims to a malicious landing page that mimics a legitimate registration portal. Once the page is loaded, the AitM infrastructure sits between the user and the authentic site, capturing login details and other sensitive information without the victim’s awareness.

Technical analysis shows the AitM component operates by proxying traffic to the genuine event site while injecting malicious scripts that record keystrokes and session tokens. This method allows threat actors to maintain persistent access to compromised accounts and to move laterally within institutional networks. The use of a man‑in‑the‑middle approach marks a step up from traditional credential‑stealing links, indicating a higher level of sophistication and resources.

Taiwan’s research community has long been a focal point for cyber espionage, given the island’s role in advanced manufacturing, semiconductor development and biomedical research. The targeting of scholars and lab personnel underscores the strategic value placed on intellectual property and scientific data. By infiltrating academic networks, adversaries can harvest unpublished findings, gain insight into emerging technologies, and potentially influence research directions.

Researchers who disclosed the campaign advise organizations to verify event communications through official channels, employ multi‑factor authentication, and monitor for anomalous traffic patterns that may indicate AitM activity. Security teams are also urged to update email filtering rules and educate staff about the hallmarks of fake invitations. As the threat landscape evolves, continued vigilance and rapid information sharing will be essential to mitigate similar attacks in the future.