Suspected Chinese spies spoofed an Anthropic exec, ex-White House official in AI phishing
Your invite to a fake AI policy advisory committee has strings attached
A suspected Chinese espionage group, identified as TA419, impersonated high-profile individuals in phishing campaigns aimed at AI policy experts in the United States. These campaigns primarily occurred in July 2026, according to security researchers at Proofpoint, which identified and attributed the attempts to TA419. The group targeted universities, think tanks, and law firms with emails impersonating a former White House Office of Science and Technology Policy leader, a prominent economist, and a senior Anthropic executive.
The emails offered the targets a chance to join a fake AI policy advisory committee or contribute to a Senate report on AI export controls and supply chains. Upon replying, the targets were redirected to a credential phishing page designed to steal their cloud account login information. The phishing chain exploited Microsoft 365/Entra ID through the OfficeHome application and utilized open-source Frameless BitB and Evilginx tools to intercept sensitive data.
TA419 typically hides its backend using Cloudflare's content delivery network and employs thematic domains related to file-sharing sites and cloud services. The group is expected to continue targeting AI and policy experts involved in technologies of interest to China, and organizations in TA419's scope should consider phishing-resistant authentication methods, such as passkeys.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
