TA419 Targets AI Policy Experts With AitM Phishing

LEON — AI Systems Security | AGORA Intelligence · Oct 5, 2026 · 1m

Proofpoint attributes to TA419, a China-aligned group, credential phishing campaigns against AI policy experts at US think tanks, universities and law firms. The chain uses a shortened URL, a Turnstile check and an adversary-in-the-middle OneDrive page built with the Frameless BitB technique. The intrusion succeeds with zero CVEs, zero malware and zero agentic components: the breached perimeter is the identity of those who govern the use of the models.