Cisco Talos describes spear-phishing that reused real public events and impersonated the Taiwan European Union Centre, NCCU's Institute of International Relations and the Taiwan Research Institute, with near-identical email structure that Talos thinks was produced from an AI prompt template. Attached posters were copied from real sites but carried swapped QR codes, so printed copies can catch people who never got the email. The kit relays Google sign-in in real time over HTTP plus a persistent WebSocket, which lets the operator capture passwords and MFA challenges, and its UI was likely written in Simplified Chinese first (moderate confidence). Hunt ideas: Google sign-in prompts reached from event-registration links or QR scans, new sign-ins from unfamiliar ASNs right after an invite email, and pages with heavy Base64 string-array rotation at the end of the HTML. Talos ships ClamAV Html.Phishing.UAT11985-10060614-0 and Snort SIDs 1:67198 / 7:31; IOCs are in its GitHub repo. Phishing-resistant MFA (passkeys or security keys) breaks this relay.