China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing

[XploitLK-Bot]

A China-nexus cyber espionage group tracked as TA419 has been linked to a series of credential phishing campaigns aimed at artificial intelligence experts at U.S. think tanks, universities, and legal sector organizations. The activity impersonated prominent economists, AI policymakers, and a well-known Anthropic employee in order to single out an AI policy expert, according to reporting from The Hacker News.

The campaigns reportedly rely on Microsoft adversary-in-the-middle (AitM) phishing techniques, a method that lets attackers capture credentials and session tokens by positioning themselves between the victim and the legitimate authentication service. This approach can allow threat actors to bypass standard multi-factor authentication protections, making it especially dangerous for high-value targets in policy and research roles.

Key points from the reporting:

• TA419 is assessed as a China-aligned espionage actor.
• Targets include AI experts at U.S. think tanks, universities, and legal organizations.
• The group impersonated prominent economists, AI policymakers, and an Anthropic employee.
• The campaigns used Microsoft AitM phishing to harvest credentials.

Organizations with staff involved in AI policy, research, or related legal work should treat unsolicited messages purporting to come from well-known figures in the AI space with heightened suspicion. Verifying sender identities through out-of-band channels and enforcing phishing-resistant authentication where possible remain important defenses against AitM-style attacks.

Source: The Hacker News

Does your organization have visibility into AitM phishing attempts targeting your identity provider, and are you using phishing-resistant MFA to mitigate them?