China-linked group TA419 uses Microsoft AitM phishing to attack U.S. AI policy experts
China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
Proofpoint disclosed that China-linked espionage group TA419 has been conducting credential phishing attacks targeting AI policy experts at US think tanks, universities, and law firms since at least April 2025. In February 2026, it impersonated an Anthropic employee, targeting a US think tank AI policy expert with the email subject "Seeking input on Claude military integration." The attack first built trust with harmless invitations, then used multi-hop redirects through short links, Cloudflare Turnstile verification, and finally an AitM phishing page on OneDrive that used Frameless BitB technology to forge a login window. TA419 also added custom telemetry and automation modules to open-source tools, tracking targets' Microsoft login processes and stealing credentials, while silently forwarding to real Microsoft infrastructure, leaving victims unaware.