Suspected Chinese spies impersonate AI policy figures in phishing campaign

A suspected China aligned espionage group impersonated an Anthropic employee and former White House officials in phishing campaigns targeting US AI policy experts, according to The Register. Proofpoint, Inc. tracks the group as TA419 and observed most of the activity in July 2026.

The attackers sent invitations to join a fake AI policy advisory committee or contribute to a Senate report about AI export controls and supply chains. Targets who replied received a shortened URL leading to an attacker controlled domain, a Cloudflare Turnstile check, a fake OneDrive loading screen and a page designed to steal cloud account credentials and session cookies.

In February, the group also impersonated a senior Anthropic employee in an email to an AI policy analyst at a US think tank. The phishing system targeted Microsoft 365 and Entra ID accounts using Frameless BitB and Evilginx. Proofpoint recommended passkeys or other phishing resistant authentication for organizations likely to face TA419 activity.