The geopolitical competition around artificial intelligence is creating a new category of cyber-espionage target: the people shaping AI policy.
A China-aligned threat group tracked as TA419 has been targeting AI experts at US think tanks, universities and legal organizations with sophisticated Microsoft credential-phishing attacks. Rather than pursuing AI models or corporate source code directly, the attackers appear interested in the people with insight into US regulation, national security strategy and the future direction of AI policy.
Proofpoint assesses the campaign as part of broader Chinese intelligence collection efforts amid growing tensions between Washington and Beijing over AI development, export controls and access to advanced technology.
Phishing Built Around AI Policy
TA419 has conducted espionage-focused credential phishing against US- and Japan-based think tanks, defense contractors, universities and law firms since at least April 2025.
Its interest in AI became particularly visible in February 2026, when attackers impersonated economists, policymakers and an Anthropic employee while targeting an AI policy expert at a US think tank. One phishing message used the subject line “Request for Feedback on Military Integration of Claude,” carefully matching the professional interests of the intended victim.
The group continued targeting AI policy experts during the summer, including campaigns that impersonated a former member of the White House Office of Science and Technology Policy leadership team.
This is highly targeted social engineering rather than mass phishing. The attackers are building messages around subjects their victims would plausibly discuss with legitimate colleagues.
The Attack Begins With a Normal Conversation
TA419 does not immediately send a malicious login page. Instead, the first email is typically harmless and designed to establish credibility.
Only after the victim responds does the attacker provide a shortened URL. That link passes through several redirects and a Cloudflare Turnstile check before eventually presenting a fake Microsoft OneDrive authentication experience.
The operation uses an adversary-in-the-middle (AitM) technique combined with a variation of browser-in-the-browser phishing known as Frameless BitB. HTML, CSS and JavaScript reproduce the appearance of a legitimate Microsoft login experience without relying on the traditional iframe approach.
TA419 has reportedly modified the open-source technique with its own telemetry and automation capabilities, allowing the infrastructure to monitor the victim’s Microsoft authentication process.
Stealing the Session, Not Just the Password
The real danger of AitM phishing is that stealing a password is only part of the objective.
The attacker’s proxy sits between the victim and Microsoft’s legitimate infrastructure. Credentials entered by the victim are forwarded to Microsoft, allowing the authentication process to complete normally while the attacker captures the resulting session information.
From the victim’s perspective, the login succeeds. There may be no obvious error message or fake destination revealing that anything went wrong.
The attacker, meanwhile, can potentially obtain the session cookies needed to impersonate the authenticated user. This is why conventional multifactor authentication does not always stop modern phishing campaigns: attackers increasingly target the authenticated session itself rather than simply collecting reusable passwords.
Phishing-resistant authentication methods such as passkeys can provide stronger protection against this type of interception.
AI Competition Is Creating Intelligence Targets
The campaign also illustrates how cyber espionage surrounding artificial intelligence is expanding beyond technology companies.
Researchers developing frontier models are obvious targets, but policy specialists can hold information that is equally valuable to a nation-state intelligence operation. They may understand upcoming regulations, government thinking around export controls, relationships between AI companies and defense organizations, or policy discussions that have not yet become public.
Proofpoint says TA419 has historically focused on defense, national security, energy, international relations and foreign policy. Targeting AI specialists therefore appears to be an extension of its existing intelligence mission rather than a completely new direction.
As AI becomes intertwined with economic and national security policy, the people shaping those decisions become part of the cybersecurity attack surface.
The TA419 campaign demonstrates that the AI race is not only being fought over GPUs, algorithms and model capabilities.It is also an intelligence contest over the people who know where policy is heading next.