China-Linked Hackers Impersonate Ex-U.S. Officials to Target AI Experts

TA419, a China-linked threat group, is targeting U.S. AI policy experts, impersonating Anthropic employees and former White House and policy officials to deliver highly convincing credential-phishing lures that redirect victims through shortened URLs to customized Microsoft OneDrive/Entra ID adversary-in-the-middle pages. The campaign leverages a customized Browser-in-the-Browser (BitB) phishing kit (Frameless BitB), Evilginx proxying, Cloudflare Turnstile filtering, and scripts that capture login flow, session tokens, and one-time codes to maintain access, indicating a sophisticated nation-state style operation aimed at harvesting intelligence on U.S. AI policy, export controls, and supply chains.