TA419 Targets AI Policy Experts with BitB and Evilginx AiTM Phishing

Proofpoint detailed a campaign by China-aligned group TA419 impersonating real AI policy, defense and research experts. The attackers chain short URLs, Cloudflare Turnstile, fake OneDrive pages, Frameless BitB and an Evilginx proxy to steal Microsoft 365 passwords, MFA codes and session cookies.

• TA419 impersonates AI policy and economics experts to build trust
• Attack chains short URLs, Turnstile, BitB and Evilginx proxy
• Targets include Japanese think tanks, defense entities, universities and law firms
• Mitigation: FIDO2 passkeys, Entra ID session revocation, IoC checks like driftshare[.]co