China-Aligned TA419 Targets US AI Experts with Phishing Campaigns

• •TA419 impersonated AI policy experts to conduct phishing attacks.
• •The phishing method involved benign outreach followed by credential theft.
• •This campaign is linked to broader Chinese intelligence objectives regarding US AI policy.

In July 2026, the China-aligned threat actor TA419 conducted credential phishing campaigns targeting AI policy experts at US think tanks, universities, and law firms. The group impersonated prominent figures, including Lynne Parker and Heidi Crebo-Rediker, to build rapport through benign emails inviting recipients to join a fictitious 'AI Policy Advisory Committee'. After initial contact, victims received a multi-stage URL redirect leading to an adversary-in-the-middle credential phishing page that captured login credentials. This activity is part of a broader Chinese intelligence effort to gather insights on US AI policy amid ongoing geopolitical tensions. TA419 has been active since at least April 2025, with previous campaigns targeting defense and national security sectors. The phishing tool used, Frameless BitB, allows real-time session hijacking, making it particularly dangerous. The group’s activities have not been publicly reported before this incident.