The campaigns reportedly rely on Microsoft adversary-in-the-middle (AitM) phishing techniques, a method that lets attackers capture credentials and session tokens by positioning themselves between the victim and the legitimate authentication service. This approach can allow threat actors to bypass standard multi-factor authentication protections, making it especially dangerous for high-value targets in policy and research roles.

Key points from the reporting:

• TA419 is assessed as a China-aligned espionage actor.
• Targets include AI experts at U.S. think tanks, universities, and legal organizations.
• The group impersonated prominent economists, AI policymakers, and an Anthropic employee.
• The campaigns used Microsoft AitM phishing to harvest credentials.

Organizations with staff involved in AI policy, research, or related legal work should treat unsolicited messages purporting to come from well-known figures in the AI space with heightened suspicion. Verifying sender identities through out-of-band channels and enforcing phishing-resistant authentication where possible remain important defenses against AitM-style attacks.

Source: The Hacker News

Does your organization have visibility into AitM phishing attempts targeting your identity provider, and are you using phishing-resistant MFA to mitigate them?