A China-aligned group (tracked as TA419) impersonated real AI policy figures and sent benign-sounding outreach to people working on AI policy at US and Japanese organizations. Once targets replied, the attackers sent a shortened link that ultimately led to a fake OneDrive/Microsoft 365 login page designed to steal credentials and hijack live sessions (including MFA).
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email from a big AI name, “AI Policy Advisory Committee” or a Senate report on AI export controls. Feels flattering, right? This is TA419’s play: once you reply, they send a shortened link that bounces through redirects into a fake OneDrive Microsoft 365 login, built with an adversary-in-the-middle kit to steal your password, MFA, and live session. The aha: a simple “happy to help” email should NOT suddenly demand a Microsoft 365 sign-in through a short link, multiple redirects, and a OneDrive page that auto-ticks “Keep me signed in.” That’s not normal policy outreach, that’s credential theft. If you get surprise “expert” outreach that suddenly wants you to log in, stop and independently verify the person and request using a trusted channel, don’t just reply and click their link.
A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…
A China-aligned group (TA419) targeted US AI policy experts by impersonating well-known AI and policy figures and sending friendly “collaboration” emails. If the target engaged, the attackers redirected them through multiple URLs to a fake Microsoft login pop-up designed to steal Microsoft 365…
A China-aligned espionage group (TA419) targeted U.S. AI policy experts by impersonating well-known public figures and sending credible policy-related invitations. After victims replied, the attackers sent shortened links that led to a fake OneDrive login designed to capture passwords, MFA codes,…
China-aligned threat actor TA419 ran real credential-phishing campaigns targeting U.S. AI policy experts at think tanks, universities, and law firms. The operation used trust-building outreach followed by a shortened link that redirected victims through checks to a fake Microsoft/OneDrive sign-in…
Researchers say a China-aligned group (TA419) impersonated well-known AI policy figures and an Anthropic executive to lure US AI policy experts into replying to emails about a fake advisory committee or Senate report. Once a target engaged, the attackers sent shortened links that led through a fake…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
