Reported by 4 outlets
China-Linked TA419 Hackers Target US AI Policy Experts With Credential Phishing Attacks
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.08 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
China-aligned actor TA419 ran customized credential-phishing campaigns against U.S. AI policy experts at think tanks, universities, and law firms, per Proofpoint tracking reported by GBHackers and The Hacker News. The operation used adversary-in-the-middle infrastructure, a modified Browser-in-the-Browser toolkit, and reply-triggered lures to steal Microsoft 365 sessions. Targets work on issues that shape U.S. AI regulation and export controls, which points to intelligence collection rather than financial motive.
Fresh reporting on October 4 and 5 filled in the social engineering. Attackers impersonated economists, policymakers, a senior Anthropic staffer, and former government officials, including ex-White House OSTP official Lynne Edwards Parker. Lures included invitations to a fabricated AI Policy Advisory Committee and requests to contribute to a fictional Senate Foreign Relations report. One email used the subject line Request for Feedback on Military Integration of Claude. After a few exchanges, targets received malware-laced documents meant to reach their cloud accounts. Proofpoint researcher Mark Kelly assessed the cohort as Chinese government-aligned based on targeting, infrastructure, technical artifacts, and industry corroboration.
Expect continued impersonation of AI-industry identities in lures, since vendor names carry trust with policy audiences. Watch for the campaign moving from session theft toward document access inside policy organizations, and for TA419 infrastructure reuse across new target sets. Organizations in the AI policy space should enforce phishing-resistant MFA, shorten M365 session lifetimes, and verify unusual requests through a second channel.
Timeline
-
original reporting
China-Linked TA419 Hackers Target US AI Policy Experts With Credential Phishing Attacks
gbhackers.com · 11d ago · October 2nd, 2026
A China-linked threat actor known as TA419 has targeted U.S. artificial intelligence policy specialists through highly customized credential-phishing operations. This campaign, which involves impersonation, adversary-in-the-middle infrastructure, and a modified Browser-in-the-Browser toolkit, aims to steal Microsoft 365 sessions. This activity indicates a focused effort to collect intelligence on individuals who influence U.S. AI regulation, export controls, […] The post China-Linked TA419 Hackers Target US AI Policy Experts With Credential Phishing Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from thehackernews.com
🤖 China-nexus group TA419 is targeting U.S. AI policy experts with reply-triggered adversary-in-the-middle phishing. Emails impersonate prom
thehackernews.com · 9d ago · October 4th, 2026
🤖 China-nexus group TA419 is targeting U.S. Emails impersonate prom
via Mastodon https://thehackernews.com/2026/10/china-aligned-ta419-targets-us-ai.html
-
update from thehackernews.com
Experts working on artificial intelligence are being targeted by sophisticated phishing scams. Attackers are impersonating colleagues to ste
thehackernews.com · 9d ago · October 4th, 2026
Experts working on artificial intelligence are being targeted by sophisticated phishing scams.
-
update from cyberworldops.eu
Proofpoint attributes credential-phishing campaigns against U.S. AI policy experts to TA419, a China-aligned espionage actor using adversary
cyberworldops.eu · 9d ago · October 4th, 2026
Proofpoint attributes credential-phishing campaigns against U.S. AI policy experts to TA419, a China-aligned espionage actor using adversary
via Mastodon https://cyberworldops.eu/en/ta419-uses-deceptive-microsoft-login-flows-to-pursue-us-ai-policy
-
mentioned by thehackernews.com
🤖 China-nexus TA419 runs AitM credential phishing against U.S. AI policy experts, impersonating economists, policymakers and an Anthropic em
thehackernews.com · 9d ago · October 4th, 2026
-
update from futurism.com
Cybercriminals who appear to be Chinese hackers pretended to be Anthropic researchers and former government officials in a scheme to obtain
futurism.com · 8d ago · October 5th, 2026
Cybercriminals who appear to be Chinese hackers pretended to be Anthropic researchers and former government officials in a scheme to obtain
via Mastodon https://futurism.com/artificial-intelligence/chinese-hackers-impersonate-anthropic-ai-secrets