China-Linked Hackers Targeted U.S. AI Experts

Threat actors launched phishing campaigns aimed at compromising Microsoft 365 sessions for U.S. policy specialists.

Updated on Oct. 2, 2026 in Cybersecurity

China-Linked Hackers Targeted U.S. AI Experts

Live Poll

Do you trust current digital security tools to protect sensitive professional communications from sophisticated cyber threats?

The China-linked threat actor TA419 has initiated credential-phishing campaigns specifically targeting U.S. artificial intelligence policy experts. The operation aims to compromise Microsoft 365 sessions to gather intelligence on key figures influencing AI regulations.

Why it matters

The campaign targets individuals who shape U.S. AI regulation and export controls, suggesting a strategic effort to gain insight into American technological policy. This activity highlights the ongoing interest foreign actors have in the development and governance of artificial intelligence.

The attackers utilized a modified Browser-in-the-Browser toolkit to facilitate session theft. The operation targeted the Microsoft 365 software platform to capture user credentials via adversary-in-the-middle infrastructure.

The players

TA419

This is a China-linked threat actor known for conducting targeted cyber espionage operations.

Microsoft 365

This is a cloud-based software platform and suite of productivity applications targeted by the attackers.

The details

Hackers employed sophisticated impersonation tactics to trick targets into interacting with malicious infrastructure. By utilizing the modified Browser-in-the-Browser technique, the threat actors were able to bypass standard security measures to steal active user sessions.

October 2, 2026: A report was published regarding the active phishing campaign.

The Tech Race

This attack mirrors state-sponsored espionage tactics that prioritize long-term intelligence gathering over immediate disruption. It reflects a shift toward highly targeted campaigns that attempt to influence global technology regulations by compromising key policy experts.

While these specific attacks focus on high-level policy experts, they serve as a reminder for users to remain vigilant against sophisticated phishing attempts and Browser-in-the-Browser exploits. Organizations should ensure multi-factor authentication is enforced to protect their Microsoft 365 accounts.

The takeaway

Maintaining strict digital hygiene and verifying the authenticity of browser pop-ups remains essential for all professionals. Users are encouraged to utilize hardware-based security keys whenever possible to prevent the theft of active session tokens.