Chinese hackers impersonate US officials in AiTM phishing attacks on AI policy experts

Proofpoint found that the China-related threat group TA419 impersonated U.S. policymakers in July and launched adversary-in-the-middle (AiTM) phishing attacks against AI experts at think tanks, universities, and law firms, stealing cloud account credentials and sessions. The attackers first built trust under the name of a fictitious "AI Policy Advisory Council" or a Senate Foreign Relations Committee report on AI export controls, then sent short links that, after multi-level redirects, led to a forged OneDrive AiTM phishing page customized from the open-source Frameless BitB tool. Proofpoint said the group has been continuously targeting U.S. and Japanese institutions since at least April 2025, and in February also impersonated an Anthropic employee targeting an AI policy expert at a think tank.