[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6kOCKJOenyZQZdoRtMatYT3B0AomCMmeSq_gF4FGeCU":3},{"article":4,"iocs":51,"watch_terms":55,"solutions":56,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"7b5d1e02-1530-4a04-9fd9-e9b9f3472759","China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing","china-aligned-ta419-targets-u-s-ai-policy-experts-with-microsoft-aitm-phishing-aac5cc","A new China-nexus cyber espionage group known as TA419 has been attributed to multiple credential phishing campaigns targeting artificial intelligence (AI) experts working for U.S. think tanks, universities, and legal sector organizations. The campaigns have impersonated prominent economists and AI policymakers, as well as a prominent Anthropic employee, to single out an AI policy expert at a","A China-aligned cyber espionage group, TA419, is conducting credential phishing campaigns against AI policy experts in US think tanks, universities, and legal organizations. The group impersonates prominent figures and uses a sophisticated Microsoft Adversary-in-the-Middle (AitM) phishing technique, leveraging a frameless browser-in-the-browser attack to steal credentials without raising suspicion.","China-aligned TA419 targets US AI policy experts with Microsoft AitM phishing.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fchina-aligned-ta419-targets-us-ai.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgR69JnEBkz8N6_Nd5K75adIWh8xVmxW8FB21gsKinx9HBzgXQSLWL5sYdKMe9d-cbTSrgc45ZtYhmvhLZJII1H-tPXKn4AiRvj4KrU8ayeZskmMCfiV-mUc2pz10MumKyXKH6ybJ2RsVj9ZZ67l-4u0Y2f5Dl3kX7PLEzCAqogMfHTSfD7gM7QypHi-yos\u002Fs1600\u002Fchina-ms.jpg","2026-10-04T07:20:32+00:00","2026-10-04T08:00:20.161654+00:00",8,[17,20,23,26,29,31],{"name":18,"type":19},"TA419","threat_actor",{"name":21,"type":22},"Microsoft AitM","product",{"name":24,"type":25},"AI","technology",{"name":27,"type":28},"Proofpoint","vendor",{"name":30,"type":22},"Claude",{"name":32,"type":22},"OneDrive","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":33,"icon":35,"name":36,"slug":37},null,"Nation-state","nation-state",[39,41,46],{"category":40},{"id":33,"icon":35,"name":36,"slug":37},{"category":42},{"id":43,"icon":35,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52],{"type":53,"value":18,"context":54},"malware","China-aligned cyber espionage group",[27,21,30],{"controls":57,"vendors":141},[58,87,116],{"slug":59,"name":60,"problem":61,"products":62},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":88,"name":89,"problem":90,"products":91},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"slug":117,"name":118,"problem":119,"products":120},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[121,128,134],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":117,"product_name":125,"url":126,"description":127},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":129,"product_name":130,"url":132,"description":133},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":135,"product_name":138,"url":139,"description":140},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[142],{"slug":143,"name":27,"logo_path":144,"roles":145},"proofpoint","\u002Fvendor-logos\u002Fproofpoint.png",[146],"reported_by",{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":164},"china-linked-ta419-uses-aitm-phishing-to-target-ai-policy-experts","China-Linked TA419 Uses AitM Phishing to Target AI Policy Experts","TA419 is exploiting human trust by impersonating well-known figures to lure high-value targets — AI policy experts at think tanks, universities, and legal organizations — into sophisticated phishing traps. The Adversary-in-the-Middle (AitM) technique combined with a browser-in-the-browser attack allows attackers to steal valid session tokens, bypassing multi-factor authentication entirely. This campaign highlights that even technically savvy professionals can be deceived when attackers invest in convincing impersonation and near-invisible credential harvesting. The targeting of AI policy influencers also signals a strategic intelligence-gathering motive, making the human element a critical national security vulnerability.",[152,153,154,155,156,157,158,159,160,161,162,163],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant Authenticators)","NIST AC-2 – Account Management","NIST AC-17 – Remote Access","NIST SI-3 – Malicious Code Protection","NIST IR-6 – Incident Reporting","MITRE ATT&CK T1557 – Adversary-in-the-Middle","MITRE ATT&CK T1566.002 – Spearphishing Link","GDPR Article 32 – Security of Processing (for EU-affiliated organizations handling personal data)",{"NIST AC-17 – Remote Access":165,"NIST AC-2 – Account Management":166,"NIST IR-6 – Incident Reporting":167,"NIST SI-3 – Malicious Code Protection":168,"CIS Control 6 – Access Control Management":169,"MITRE ATT&CK T1566.002 – Spearphishing Link":170,"MITRE ATT&CK T1557 – Adversary-in-the-Middle":171,"CIS Control 9 – Email and Web Browser Protections":172,"CIS Control 14 – Security Awareness and Skills Training":173,"CIS Control 4 – Secure Configuration of Enterprise Assets":174,"NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant Authenticators)":175,"GDPR Article 32 – Security of Processing (for EU-affiliated organizations handling personal data)":176},"Remote access controls requiring compliant devices and continuous session checks reduce the value of tokens captured through AitM phishing.","Account management that monitors sessions for unusual locations or devices helps detect a stolen token being replayed by TA419.","Fast incident reporting lets a target who suspects a TA419 lure trigger session revocation before stolen tokens are used.","Malicious code and content protection, including web filtering, can stop users reaching the credential harvesting pages used in this campaign.","Access control that binds sessions to devices and requires phishing-resistant MFA limits what TA419 can do with session tokens stolen through AitM phishing.","Spearphishing links were TA419's delivery route, so link analysis and training on unexpected invitations from public figures target the entry point.","This technique describes TA419's core method: proxying the real login to capture session tokens and bypass MFA, which phishing-resistant authentication defeats.","Email and browser protections such as link scanning and domain filtering can block the AitM phishing pages TA419 sent to AI policy experts.","Awareness training on impersonation of well-known figures and fake login windows helps even savvy experts spot TA419's tailored lures.","Hardened browser configuration, such as blocking pop-up style login windows and limiting extensions, makes TA419's browser-in-the-browser fake sign-in pages less effective.","Phishing-resistant authenticators such as FIDO2 keys bind login to the real domain, so TA419's AitM proxy could not capture a usable session token.","Organisations holding EU personal data must apply appropriate security, which includes phishing-resistant MFA against token theft campaigns like TA419's."]