A hacking group aligned with Chinese interests, identified as TA419, has been impersonating an Anthropic executive to target experts in United States artificial intelligence policy. This activity has been linked to credential-phishing efforts aimed at professionals in think tanks, academic institutions, and legal firms. The primary objective appears to be gathering intelligence on US regulations and strategies concerning AI.
Impersonation Efforts of TA419
Since being tracked by Proofpoint, TA419 has conducted campaigns against various US and Japanese entities, including defense contractors and legal organizations. Notably, in February 2026, the group posed as a senior employee from Anthropic to engage with an AI policy analyst at a US think tank. Their message, titled “Request for Feedback on Military Integration of Claude,” took advantage of ongoing public discussions about the military applications of AI technologies developed by Anthropic.
Expanding their efforts in July, the attackers impersonated prominent figures such as Lynne Edwards Parker, a former senior White House official, and economist Heidi Crebo-Rediker. These messages invited recipients to a fictitious “AI Policy Advisory Committee” or to contribute to a Senate report on AI export controls.
Phishing Techniques and Tactics
The initial emails from TA419 were designed to initiate conversations rather than request immediate credentials. Once a target responded, the hackers sent a shortened link promising more information, creating an appearance of a legitimate professional dialogue. This strategy increased the likelihood of recipients clicking on malicious links.
These links led to attacker-controlled domains, where sophisticated phishing techniques were employed, such as adversary-in-the-middle (AitM) phishing. Utilizing a modified Frameless BitB toolkit, the attackers created believable login screens that mimicked genuine Microsoft processes, allowing them to capture session cookies.
Protective Measures and Observations
TA419 leveraged Cloudflare to conceal their infrastructure and used domains that mimicked cloud-sharing services. The group’s activities underscore the need for organizations to independently verify unexpected invitations and enhance their authentication systems to resist phishing.
Previous attacks, like those by SugarGh0st on AI researchers, highlight the persistent interest in AI expertise for intelligence purposes. While it remains unclear if TA419 successfully compromised any accounts, the sophistication of their tactics underscores the importance of vigilant cybersecurity practices.
To mitigate such threats, organizations are advised to implement robust security measures, including phishing-resistant authentication and thorough investigation of unusual cloud activity. Continuous education and awareness can also help in identifying and thwarting such advanced cyber threats.
