Suspected Chinese spies spoofed an Anthropic exec, ex-White House official in AI phishing

Security researchers attribute July 2026 phishing campaigns to China-aligned TA419, which impersonated AI policy figures (including an Anthropic exec and a former White House official) to target US AI policy experts at universities, think tanks, and law firms. Victims were lured to file-sharing themed domains that performed Cloudflare Turnstile checks behind a fake OneDrive screen and redirected to attacker-controlled AitM credential phishing pages (using Frameless BitB and Evilginx) to steal Microsoft 365/Entra ID logins; Proofpoint published numerous spoofed domains and recommended phishing-resistant, origin-bound authentication.