[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2rNeupDxuHINWW7cxw2QukfgGDsBnUL17YI69s40wLM":3},{"article":4,"iocs":48,"watch_terms":53,"solutions":54,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"28a4f459-1a91-48c0-a55a-841418f33d03","AI policy circles targeted in China-linked phishing operation","ai-policy-circles-targeted-in-china-linked-phishing-operation-fffd72","Cybersecurity firm Proofpoint said TA419 impersonated officials and AI industry figures in an effort to gain access to cloud accounts held by U.S. think tank, university and legal-sector experts. The post AI policy circles targeted in China-linked phishing operation appeared first on CyberScoop.","A China-aligned espionage group, TA419, has been targeting U.S. AI policy experts with phishing campaigns. The group impersonates officials and AI industry figures to gain access to cloud accounts, using a modified open-source tool to create fake Microsoft login pages. This activity aligns with broader U.S.-China competition in AI development and national security.","China-linked TA419 group targets US AI policy experts via phishing.","https:\u002F\u002Fcyberscoop.com\u002Fchina-cyber-espionage-ta419-phishing-us-ai-policy-experts\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F10\u002FGettyImages-2276184284-1-1.jpg","2026-10-01T14:06:19+00:00","2026-10-01T16:00:08.562444+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"TA419","threat_actor",{"name":21,"type":22},"Proofpoint","vendor",{"name":24,"type":25},"Claude AI","product",{"name":27,"type":25},"Microsoft OneDrive",{"name":29,"type":22},"Anthropic","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,38,43],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":50,"value":51,"context":52},"malware","Frameless BitB","Open-source phishing tool modified and used by TA419",[21,29,24],{"controls":55,"vendors":138},[56,85,113],{"slug":57,"name":58,"problem":59,"products":60},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":86,"name":87,"problem":88,"products":89},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[90,97,105],{"vendor_slug":91,"vendor_name":21,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"slug":114,"name":115,"problem":116,"products":117},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[118,124,131],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":119,"product_name":120,"url":122,"description":123},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":114,"product_name":128,"url":129,"description":130},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":132,"product_name":135,"url":136,"description":137},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[139],{"slug":91,"name":21,"logo_path":92,"roles":140},[141],"reported_by",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":157},"china-linked-group-phishes-ai-policy-experts-via-fake-microsoft-login-pages","China-Linked Group Phishes AI Policy Experts via Fake Microsoft Login Pages","TA419, a China-aligned espionage group, is conducting targeted spear-phishing campaigns against U.S. AI policy professionals by impersonating trusted officials and industry figures to steal cloud account credentials. The attackers leverage a modified open-source tool to craft convincing fake Microsoft login portals, exploiting the trust and credibility that high-profile impersonation provides. This campaign highlights how nation-state actors increasingly target intellectual and policy communities — not just technical infrastructure — to gain strategic intelligence advantages. The consequences extend beyond individual account compromise, potentially exposing sensitive AI policy deliberations, research, and national security-relevant discussions to a foreign adversary.",[147,148,149,150,151,152,153,154,155,156],"CIS Control 14 – Security Awareness and Skills Training","CIS Control 6 – Access Control Management","CIS Control 9 – Email and Web Browser Protections","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 IA-5 – Authenticator Management","NIST SP 800-53 SI-8 – Spam Protection","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST Phishing Guidance (SP 800-177)","MITRE ATT&CK T1566.002 – Phishing: Spearphishing Link","MITRE ATT&CK T1078 – Valid Accounts",{"NIST Phishing Guidance (SP 800-177)":158,"MITRE ATT&CK T1078 – Valid Accounts":159,"NIST SP 800-53 SI-8 – Spam Protection":160,"NIST SP 800-53 AC-2 – Account Management":161,"CIS Control 6 – Access Control Management":162,"NIST SP 800-53 IA-5 – Authenticator Management":163,"CIS Control 9 – Email and Web Browser Protections":164,"MITRE ATT&CK T1566.002 – Phishing: Spearphishing Link":165,"NIST SP 800-53 AT-2 – Literacy Training and Awareness":166,"CIS Control 14 – Security Awareness and Skills Training":167},"Email authentication such as DMARC makes it harder to spoof trusted senders used in these lures.","Covers use of stolen credentials to access accounts, the aim of this campaign.","Spam and phishing filtering can block TA419's lures before they reach targets.","Account management helps detect and contain compromised cloud accounts.","Access control, including phishing-resistant MFA, limits what stolen cloud credentials can do.","Managing authenticators, such as moving to phishing-resistant methods, protects against credential theft.","Email and browser protections can block links to fake Microsoft login pages.","Covers phishing emails with links to fake login pages, the technique TA419 used.","Training helps staff verify unexpected messages, even when they appear to come from known officials.","Training helps AI policy staff spot spear-phishing impersonating trusted officials."]