China-Linked TA419 Targets AI Policy Experts in Sophisticated Phishing Campaign
China-aligned cyber espionage group TA419 conducted sophisticated phishing campaigns targeting U.S. AI policy experts, researchers, and think tank analysts from February through July 2025. The threat actors impersonated high-profile officials including former White House OSTP deputy director Lynne Parker, economist Heidi Crebo-Rediker, and senior Anthropic employees to establish trust with targets. Using adversary-in-the-middle techniques and modified Frameless BitB tools, attackers created fake Microsoft OneDrive sign-in pages to harvest credentials and active browser sessions from victims at universities, law firms, and defense contractors. This campaign represents a strategic shift toward targeting AI policy development and export control discussions amid escalating U.S.-China technological competition. The attacks demonstrate increasing sophistication in social engineering, leveraging current geopolitical tensions around AI governance, military applications, and semiconductor supply chains to make their impersonation attempts more credible and urgent.
Kill Chain
