China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing

China-aligned TA419 phished U.S. AI policy experts using Microsoft adversary-in-the-middle credential theft.

Proofpoint attributes multiple credential-phishing campaigns to China-aligned espionage group TA419, active since at least April 2025 against U.S. and Japanese think tanks, defense contractors, universities, and law firms. In February 2026 the group impersonated economists, AI policymakers, and an Anthropic employee to target a U.S. think-tank AI policy expert with a message titled "Request for Feedback on Military Integration of Claude." After a benign opener, a shortened URL passes a Cloudflare Turnstile check and lands on a OneDrive adversary-in-the-middle page using frameless browser-in-the-browser techniques. A custom module tracks the Microsoft sign-in flow, proxies it to real Microsoft infrastructure, and captures credentials and session cookies.