🚨TA419 Phishes US AI Experts with Fake Policy Committees
Chinese Espionage Group Targets US AI Policy Experts
TL;DR
TA419, a suspected Chinese espionage group, launched phishing campaigns in July 2026, impersonating AI policy figures to target US experts. The attacks used fake domains and phishing emails to steal credentials, posing a significant threat to national security.
TA419, a suspected Chinese espionage group, launched phishing campaigns in July 2026, impersonating AI policy figures to target US experts at universities, think tanks, and law firms. The attacks used fake domains and phishing emails to steal credentials, posing a significant threat to national security and the integrity of AI policy discussions. The campaigns involved impersonating specific individuals, including a former member of the White House Office of Science and Technology Policy, and used shortened URLs to redirect victims to attacker-controlled domains. TA419's phishing chain targets Microsoft 365/Entra ID through the first-party OfficeHome application, using open-source Frameless BitB for phishing.
Key Points
TA419's July 2026 campaigns impersonated AI policy figures, targeting US experts with phishing emails.
The phishing emails invited targets to join fake AI policy advisory committees or contribute to Senate reports.
First-stage domain: driftshare[.]co; second-stage domain: globalfileshareplatform[.]com.
TA419 uses open-source Frameless BitB for phishing, targeting Microsoft 365/Entra ID through OfficeHome.
Cloudflare's CDN hides backend hosting IP addresses for TA419's domains, complicating detection.
Why It Matters
TA419's phishing campaigns targeting US AI policy experts pose a significant threat to national security and the integrity of AI policy discussions. Organizations in the scope of TA419 activity should consider phishing-resistant, origin-bound authentication such as passkeys. Experts working on technologies of interest to the Chinese government are particularly at risk.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,569 builders reading daily.