TA419, a China-aligned espionage group, posed as former White House officials and other prominent figures to target US AI policy experts with credential phishing campaigns in 2026. The operation used fake OneDrive login pages, browser-in-the-browser tricks, and cloud infrastructure to steal Microsoft credentials, session cookies, and access to victim accounts. #TA419 #LynneEdwardsParker #HeidiCreboRediker #Anthropic #WhiteHouseOfficeofScienceandTechnologyPolicy
Keypoints
- TA419 targeted US AI policy experts with impersonation-based phishing campaigns.
- The group pretended to be White House and policy figures to build trust.
- Victims were lured into fake AI advisory and export control discussions.
- The phishing flow led to a fake OneDrive page built to steal Microsoft credentials and session cookies.
- TA419 used Cloudflare, NameSilo, and lookalike domains tied to organizations such as the Heritage Foundation and the Japan-Taiwan Exchange Association.
Read More: https://www.helpnetsecurity.com/2026/10/02/china-aligned-ta419-phishing-ai-policy-experts/