A China-aligned espionage group (TA419) targeted U.S. AI policy experts by impersonating well-known public figures and sending credible policy-related invitations. After victims replied, the attackers sent shortened links that led to a fake OneDrive login designed to capture passwords, MFA codes, and session cookies for cloud account takeover.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email from a former White House science advisor inviting you to join an AI Policy Advisory Committee. No links, just a friendly, detailed note. You reply. Then comes the hook: a follow-up with a shortened URL to “view additional information” on OneDrive. That link actually leads to a fake OneDrive adversary-in-the-middle page using a browser-in-the-browser, or BitB, fake Chrome login window. This kit relays everything you type, your password, MFA code, even session cookies, so TA419 can take over your cloud account, whether it’s OneDrive or a shared Anthropic Claude document link. The giveaway is the weird login flow: a OneDrive lookalike with a login window floating inside the page instead of your browser’s real tab bar. If any high-profile invite suddenly turns into a shortened link and a strange cloud login popup, stop and forward it to security before you click or sign in.
A China-aligned group (TA419) targeted US AI policy experts by impersonating well-known AI and policy figures and sending friendly “collaboration” emails. If the target engaged, the attackers redirected them through multiple URLs to a fake Microsoft login pop-up designed to steal Microsoft 365…
Researchers say a China-aligned group (TA419) impersonated well-known AI policy figures and an Anthropic executive to lure US AI policy experts into replying to emails about a fake advisory committee or Senate report. Once a target engaged, the attackers sent shortened links that led through a fake…
A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…
Proofpoint linked China-nexus actor TA419 to credential-phishing campaigns aimed at U.S. AI policy experts, including people at think tanks. The attacker impersonated well-known AI policymakers and an Anthropic executive, using believable “advisory committee” and “research questions” emails to draw…
A China-aligned group (tracked as TA419) impersonated real AI policy figures and sent benign-sounding outreach to people working on AI policy at US and Japanese organizations. Once targets replied, the attackers sent a shortened link that ultimately led to a fake OneDrive/Microsoft 365 login page…
China-aligned threat actor TA419 ran real credential-phishing campaigns targeting U.S. AI policy experts at think tanks, universities, and law firms. The operation used trust-building outreach followed by a shortened link that redirected victims through checks to a fake Microsoft/OneDrive sign-in…
