China Aligned TA419 Targets US AI Experts With Phishing Attacks

A China-aligned cyber espionage group known as TA419 has targeted artificial intelligence policy experts in the United States with credential phishing campaigns, according to reports from The Hacker News, news.lavx.hu, and gbhackers.com. The espionage group focused on individuals working for U.S. think tanks, universities, and legal sector organizations by deploying Microsoft adversary-in-the-middle phishing attacks. [1][2][3]

The Hacker News reported that the malicious campaigns used reply-triggered adversary-in-the-middle phishing designed to capture Microsoft login credentials and session cookies. In February 2026, the attackers targeted an artificial intelligence policy expert at a U.S. think tank by impersonating a prominent Anthropic employee. The group also impersonated prominent economists and artificial intelligence policymakers during its operations. [1]

According to The Hacker News, the phishing email sent to the think tank expert used the subject line Request for Feedback on Military Integration of Claude. This form of attack transparently relays authentication processes to a legitimate website, which allows the attackers to hijack active user sessions and collect sensitive credentials. [1][6]

Phishing remains a primary method for gaining initial access to systems, enabling session hijacking, credential theft, malware delivery, or command execution. Strategic cyberwarfare involves targeting information systems for tactical or military purposes, encompassing cyberattacks attributed to state organs and related advanced persistent threat groups in the People's Republic of China. [4][6]