A China-aligned cyber espionage group targeted U.S. artificial intelligence policy experts through phishing emails that impersonated prominent officials, economists and an employee of AI company Anthropic, according to research released Thursday by Proofpoint.
The campaigns, which the cybersecurity company attributed to a group it calls TA419, sought access to cloud accounts held by people at think tanks, universities and law firms. The activity comes amid growing U.S.-China competition over AI development, export controls, semiconductor supply chains and military uses of the technology.
Proofpoint said the group began a campaign in July by impersonating Lynne Parker, a former principal deputy director of the White House Office of Science and Technology Policy, and economist and foreign policy expert Heidi Crebo-Rediker. The emails invited recipients to join a supposed AI policy advisory committee or contribute to a report on AI export controls and supply chains.
The initial messages did not immediately request passwords or direct recipients to a sign-in page. Instead, they appeared designed to begin a conversation and establish trust. After a target replied, the group sent a shortened link said to contain more information.
The link redirected recipients through several websites before leading to a false Microsoft OneDrive sign-in page. Proofpoint said the setup was intended to capture account credentials and active browser sessions.
The firm described the operation as an adversary-in-the-middle phishing attack. In such attacks, the victim interacts with genuine Microsoft infrastructure during part of the process, looking and behaving like a legitimate sign-in. The person may enter a password, complete a multifactor authentication prompt and pass access checks while the attacker captures the session information created by the login.