Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

TA419 AI policy impersonation phishing campaign

Campaign
First reported
Last updated
Happening score
H score 36
2 unique sources, 2 articles

Summary

Hide ▲

TA419 is a China-nexus espionage campaign that used credential phishing against AI policy experts at U.S. think tanks, universities, and legal sector organizations, with additional targeting of defense contractors and Japan-linked institutions. The lures impersonated economists, AI policymakers, Lynne Parker, Heidi Crebo-Rediker, and an Anthropic employee, including a February 2026 message with the subject “Request for Feedback on Military Integration of Claude.” Recipients who responded were pushed through shortened URLs and multi-stage redirects to a spoofed OneDrive sign-in page. The page used Frameless BitB and an adversary-in-the-middle (AitM) proxy to relay Microsoft 365 logins, capture passwords, MFA codes, and session cookies, and keep the sign-in appearing successful. Proofpoint says the activity has run since at least April 2025 and likely supports Chinese intelligence collection on U.S. AI policy and export-control issues.

Related Happenings

Cybersecurity professionals report persistent password reliance and rising AI-driven phishing and deepfake targeting

Trend
H score39 First: 07.10.2026 13:15 Last: 07.10.2026 13:15 Sources 1

About this happening: Survey data from 2,000 cybersecurity professionals shows persistent reliance on usernames and passwords alongside a rise in AI-driven phishing and deepfake impersona...

Open Happening

CSuite phishing campaign stealing Microsoft 365 sessions and deploying remote-access tools

Campaign
H score30 First: 30.09.2026 13:45 Last: 30.09.2026 13:45 Sources 1

About this happening: The CSuite phishing campaign is stealing Microsoft 365 sessions and deploying ScreenConnect or Action1, creating paths to account takeover, endpoint control, and b...

Open Happening

Global Profit PhaaS logistics-fraud platform

Threat Actor Meta
H score27 First: 24.09.2026 15:05 Last: 24.09.2026 15:05 Sources 1

About this happening: Global Profit (aka MC Profit Always) is a PhaaS operation tied to a Russian-Armenian threat actor that sells logistics-focused credential theft to other operators. The...

Open Happening

ShinyHunters and Helix passkey-themed Microsoft 365 account compromise campaign

Campaign
H score34 First: 11.09.2026 20:26 Last: 11.09.2026 20:26 Sources 1

About this happening: A ShinyHunters- and Helix-linked campaign is using passkey and SSO-themed social engineering to compromise corporate Microsoft accounts, exposing Microsoft 3...

Open Happening

Anthropic Claude misuse analysis of multi-agent reconnaissance, exploitation, and exfiltration

Technical Analysis
H score59 First: 11.09.2026 17:29 Last: 11.09.2026 17:29 Sources 1

About this happening: Anthropic says Claude AI was abused by multiple threat groups, including ShinyHunters, Midnight Blizzard, and GTG-10007, for credential harvesting, recon...

Open Happening

Timeline

  1. 01.10.2026 17:00 1 articles · 12d ago

    TA419 sent AI-policy phishing emails posing as Lynne Parker and Heidi Crebo-Rediker

    Exploitation Observed

    TA419 sent emails from July 8 while posing as Lynne Parker and later economist and foreign policy expert Heidi Crebo-Rediker to lure AI policy specialists with a made-up "AI Policy Advisory Committee" invitation and a request to help with a Senate Committee on Foreign Relations report on AI export controls; recipients who replied were pushed through shortened links and redirects to a spoofed OneDrive login page.

    Show sources
    Open in new tab
  2. 01.10.2026 17:00 3 articles · 12d ago

    Proofpoint details TA419 credential phishing against AI policy specialists at US and Japan institutions

    Initial Disclosure

    Proofpoint's October 1 research said TA419 has run credential phishing against staff at think tanks, defense contractors, universities and law firms in the US and Japan since at least April 2025, using a spoofed Microsoft 365/OneDrive login page built as an adversary-in-the-middle reverse proxy from Frameless BitB to forward Microsoft 365 logins in real time, capture passwords, MFA codes and session cookies, and bypass conditional access checks; Proofpoint assessed the activity as likely supporting Chinese intelligence gathering on US AI policy and advised phishing-resistant sign-in methods such as passkeys and verification through an independent channel.

    Show sources
    Open in new tab