Executive Summary
Beginning in early 2026, the China-aligned threat actor TA419 has targeted US-based artificial intelligence (AI) policy experts, think tanks, and legal organizations. The group uses sophisticated social engineering, impersonating prominent economists and AI policymakers to invite targets to participate in fictitious advisory committees or research reports. These operations likely support Chinese strategic intelligence goals regarding US AI regulatory frameworks and export controls.
The attack chain involves benign rapport-building emails followed by multi-stage URL redirections. Attackers utilize an Adversary-in-the-Middle (AitM) infrastructure built on a customized version of the open-source 'Frameless BitB' (Browser-in-the-Browser) kit. This setup allows TA419 to bypass multi-factor authentication (MFA) by relaying genuine Microsoft 365 login sessions in real-time and capturing session cookies, effectively automating the compromise of cloud accounts.
TA419's focus on emerging technology policy represents a targeted expansion of their long-standing interest in US and Japanese national security, energy, and defense sectors. The use of specialized phishing kits and anonymization infrastructure, including VPS networks and residential proxies, highlights the group's technical maturity and persistent nature.