China-Linked Hackers Impersonate AI Experts to Target US Policy Insiders

Proofpoint attributes a credential-phishing campaign since at least April 2025 to a China-aligned group tracked as TA419 that impersonated AI policy figures and economists to lure U.S. and Japanese think-tank, university, law firm and contractor staff; victims who engaged were sent shortened links to a spoofed OneDrive page that used an AitM reverse-proxy (Frameless BitB) to capture Microsoft 365 passwords, MFA codes and session cookies, allowing the attackers to bypass MFA and maintain access. Proofpoint views the activity as espionage targeting AI policy development and advises adopting phishing-resistant sign-in methods and verifying unexpected outreach via independent channels.