China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
Summary: Proofpoint attributes a China-aligned espionage group, TA419, to credential phishing campaigns impersonating prominent economists, AI policymakers, and an Anthropic employee to target AI policy experts at U.S. think tanks, universities, and legal organizations, including a February 2026 email with the subject line "Request for Feedback on Military Integration of Claude." The group, active since at least April 2025 against U.S.- and Japan-based think tanks, defense contractors, universities, and law firms, uses a shortened URL and multi-stage redirect chain to an OneDrive adversary-in-the-middle page that employs Frameless BitB and a bespoke telemetry module to capture Microsoft sign-in credentials and session cookies while relaying them to real Microsoft infrastructure.
What you should know: The victim's sign-in succeeds and nothing looks wrong, so the stolen session cookies let TA419 into the account without triggering an alert - and Proofpoint frames this AI policy targeting as an extension of the group's existing remit against defense, national security, energy, and foreign policy targets, not a new one.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026