Researchers reported two China-aligned campaigns that used phishing and impersonation to target AI policy experts and multiple Asian government organizations. One campaign built rapport with “AI policy” themed outreach before sending links to a OneDrive credential-harvesting page, while another used spear-phishing emails with decoy documents to deliver malware for espionage.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get this email: “Invitation to join an AI Policy Advisory Committee,” supposedly from a former White House science official. Researchers say China-linked groups are doing this for real, impersonating economists and policy experts, asking you to join a fake AI committee or contribute to a Senate report, just to get you to reply. Here’s the trick: once you respond, they send a link that bounces through redirects into a OneDrive login page. It looks normal, but it’s a credential phish built to steal your username and password. If you get an unexpected policy invite or briefing, and it leads to a login page after a few redirects, stop. Don’t sign in there, go to the service directly and log in from a fresh browser tab.
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
A China-nexus threat group targeted government and policy organizations across Asia using spear-phishing emails tailored to the victim’s interests. The emails used spoofed trusted senders and a realistic fake Gmail attachment preview that linked to attacker-controlled pages, ultimately installing…
A real campaign is targeting logistics firms with fake Google Play pages impersonating well-known logistics brands to trick employees into installing an Android spyware app. Once installed, the spyware can steal newly received SMS messages (including one-time passcodes) and enable call forwarding,…
A China-linked espionage group (UAT-11587) targeted Asian government and policy organizations using highly tailored phishing emails and realistic decoy documents. After a click, malware ultimately installed the “Antino” backdoor, which then hid its command-and-control traffic inside normal…
Researchers say a China-aligned group (TA419) impersonated well-known AI policy figures and an Anthropic executive to lure US AI policy experts into replying to emails about a fake advisory committee or Senate report. Once a target engaged, the attackers sent shortened links that led through a fake…
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
