China-Linked TA419 Phishes U.S. AI Policy Experts Via Microsoft AitM Attacks

A China-aligned cyber espionage group, TA419, has been targeting U.S. AI policy experts with sophisticated credential phishing campaigns. The group impersonates prominent figures, including economists and AI policymakers, to lure targets into providing their credentials through a multi-stage redirection chain that leads to a fake OneDrive login page. The attacks use a technique called Frameless BitB, which spoofs trusted websites within a legitimate browser session. Proofpoint describes TA419 as a threat actor focused on espionage, with a history of targeting think tanks, defense contractors, universities, and law firms in the U.S. and Japan. The group’s activities align with broader Chinese intelligence objectives to understand U.S. AI policy and regulatory developments.