TA419 China-aligned phishing campaign impersonates Anthropic and US officials to target AI policy experts

On 2 October 2026, threat-intelligence firm Proofpoint disclosed a China-aligned espionage campaign, tracked as TA419, that impersonated prominent figures in US artificial-intelligence policy to phish experts at American think tanks and research organisations. In a report authored by analyst Mark Kelly, Proofpoint said the activity likely supports broader Chinese intelligence objectives as governments race to shape AI policy and military applications.

The operators impersonated a senior Anthropic employee in February 2026 to approach an AI policy analyst, using an email subject referencing the debate over military integration of Anthropic's Claude models. Beginning 8 July 2026, TA419 expanded the effort by posing as former US officials — Lynne Edwards Parker, a former Principal Deputy Director of the White House Office of Science and Technology Policy, and economist and foreign-policy expert Heidi Crebo-Rediker.

Technique

The campaign relied on social-engineering lures rather than malware. Initial emails carried no malicious links and instead invited targets to join fictitious bodies such as an "AI Policy Advisory Committee" or to contribute to policy reports. Once a target engaged, follow-up messages used shortened URLs leading to fake OneDrive credential-phishing pages. The attackers deployed Frameless BitB, an open-source browser-in-the-browser tool that simulates a Chrome login window, to capture credentials, multi-factor authentication codes and session cookies. TA419's infrastructure used Cloudflare's CDN and domains registered through NameSilo.

Significance

Proofpoint found no evidence of successful breaches of the targeted organisations, but noted that Beijing-linked groups typically persist until they succeed. The campaign illustrates how AI policy itself has become an intelligence target: rather than steal model weights, the operators sought access to the experts shaping export controls and the military use of AI, where email inboxes can be as valuable as the technology they discuss.