TA419 (Threat actor): news timeline & CVEs

Suspected Chinese spies spoofed an Anthropic exec, ex-White House official in AI phishingnew

China-linked TA419 phished US AI policy experts by spoofing an Anthropic executive and former White House officials.

Proofpoint attributes July 2026 credential-phishing campaigns against US AI policy experts at universities, think tanks, and law firms to China-aligned TA419. The group spoofed former White House OSTP official Lynne Edwards Parker and economist Heidi Crebo-Rediker, and in February spoofed a senior Anthropic employee with a lure about military use of Claude. Replies led via shortened links, a Cloudflare Turnstile check, and a fake OneDrive screen to an attacker-in-the-middle page. The kit, built on Frameless BitB and Evilginx, targeted Microsoft 365 and Entra ID through OfficeHome and stole usernames, passwords, and session cookies.

The Register · Security16:43 UTC · 44m agoThreat actor in the wild 4 sources

Chinese Hackers Posing as Senior Anthropic Employee Targeting US AI Policy Experts

China-linked TA419 impersonated an Anthropic employee to phish US AI policy experts for Microsoft 365 sessions.

Proofpoint says China-aligned TA419 impersonated a senior Anthropic employee and former US policy figures to phish AI policy experts at think tanks, universities, law firms, and related organizations. After an initial email exchange, shortened links sent victims through attacker sites into a Frameless BitB and Evilginx-style proxy of Microsoft 365 and Entra ID sign-in. The flow captured session cookies and handled MFA so attackers could obtain a usable cloud session. Campaigns have been tracked since at least April 2025, but successful account compromise is not confirmed.

Cyber Security Newsupdated 16:43 UTC · 44m agofirst 14:44 UTC · 2h agoThreat actor in the wild 4 sources

AI policy circles targeted in China-linked phishing operation

China-aligned TA419 ran adversary-in-the-middle phishing campaigns impersonating officials and an Anthropic staffer to steal credentials from U.S. AI policy experts.

Proofpoint attributed phishing campaigns to China-aligned group TA419 targeting U.S. AI policy experts at think tanks, universities, and law firms since at least April 2025. A July campaign impersonated former White House OSTP official Lynne Parker and economist Heidi Crebo-Rediker, using a modified open-source Frameless BitB tool to present fake Microsoft OneDrive sign-in pages that captured credentials and active browser sessions. A February campaign impersonated a senior Anthropic employee to solicit feedback on military use of Claude models. No victims or compromises were confirmed, and Proofpoint did not directly link the activity to the Chinese government.

CyberScoopupdated 16:43 UTC · 44m agofirst 14:06 UTC · 3h agoThreat actor 4 sources

China-Linked Hackers Impersonate AI Experts to Target US Policy Insiders

China-linked TA419 phishes US AI-policy staff using expert impersonation and a Microsoft 365 session-stealing proxy.

Proofpoint's first public report on TA419 says the China-aligned group has conducted credential phishing since at least April 2025 against think tanks, defense contractors, universities, and law firms in the United States and Japan. From July 8 the attackers impersonated former White House science official Lynne Parker and economist Heidi Crebo-Rediker, after earlier using a senior Anthropic employee's identity, with fake AI-policy and export-control pretexts. Links redirected victims to a spoofed OneDrive page built with the Frameless BitB adversary-in-the-middle kit, which proxies Microsoft 365 logins and captures passwords, MFA codes, and session cookies. Proofpoint assesses the campaign as likely supporting Chinese intelligence gathering on US AI policy and export controls.

Infosecurity Magazineupdated 16:43 UTC · 44m agofirst 14:00 UTC · 3h agoThreat actor in the wild 4 sources

TA419

Timeline4 articles

Appears with

Suspected Chinese spies spoofed an Anthropic exec, ex-White House official in AI phishingnew

Chinese Hackers Posing as Senior Anthropic Employee Targeting US AI Policy Experts

AI policy circles targeted in China-linked phishing operation

China-Linked Hackers Impersonate AI Experts to Target US Policy Insiders