China-Linked Hackers Target U.S. AI Experts With Browser-in-the-Browser Phishing

Proofpoint observed China-aligned APT TA419 targeting U.S. AI policy experts in July 2026 with multi-stage credential-phishing campaigns that began with benign outreach and progressed to adversary-in-the-middle Browser-in-the-Browser pages to capture Microsoft 365 session cookies (including sessions protected by MFA). The report details the phishing infrastructure, artifacts (emails, domains, TLS fingerprint), victim sectors, and recommends phishing-resistant authentication and verification of unexpected advisory invitations.