--- title: Suspected Chinese spies spoofed an Anthropic exec,... description: A China-aligned espionage group tracked as TA419 impersonated a senior Anthropic employee, a former White House Office of Science and Technology Policy... canonical: https://daily.dev/posts/suspected-chinese-spies-spoofed-an-anthropic-exec-ex-white-house-official-in-ai-phishing-wx4wtoums twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Suspected Chinese spies spoofed an Anthropic exec, ex-White House official in AI phishing | daily.dev og:description: A China-aligned espionage group tracked as TA419 impersonated a senior Anthropic employee, a former White House Office of Science and Technology Policy... og:url: https://daily.dev/posts/suspected-chinese-spies-spoofed-an-anthropic-exec-ex-white-house-official-in-ai-phishing-wx4wtoums og:image: https://api.daily.dev/og/posts/Wx4WToUMS.png og:image:alt: Suspected Chinese spies spoofed an Anthropic exec, ex-White House official in AI phishing og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Suspected Chinese spies spoofed an Anthropic exec, ex-White House official in AI phishing **[The Register](https://daily.dev/sources/theregister)** · 4 min read · 0 upvotes · 0 comments ## Summary A China-aligned espionage group tracked as TA419 impersonated a senior Anthropic employee, a former White House Office of Science and Technology Policy official, and other AI policy figures in phishing campaigns targeting AI policy experts at US think tanks, universities, and law firms, Proofpoint reports. The July 2026 campaigns invited victims to join a fake AI policy advisory committee, then directed them through a Cloudflare Turnstile check and a fake OneDrive page to an attacker-in-the-middle credential phishing page built on open source Frameless BitB tooling, targeting Microsoft 365/Entra ID logins via the OfficeHome application. TA419 also spoofed an Anthropic employee in February during US military pressure on Anthropic over Claude's safeguards, and has impersonated other organizations like The Heritage Foundation and a Japanese minister's office. Proofpoint recommends phishing-resistant authentication such as passkeys. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is TA419 and what phishing technique did it use against AI policy experts? TA419 is a China-aligned espionage group that impersonated a senior Anthropic employee and a former White House Office of Science and Technology Policy official to phish AI policy experts at US think tanks, universities, and law firms. Starting July 2026, it used attacker-in-the-middle phishing built on open source Frameless BitB, combining a Browser-in-the-Browser overlay with an Evilginx phishlet to steal Microsoft 365 usernames, passwords, and session cookies via the OfficeHome application. _Security teams tracking nation-state phishing tactics like TA419's can follow related coverage on daily.dev._ ### How does the Frameless BitB phishing kit steal Microsoft 365 credentials? Frameless BitB combines a Browser-in-the-Browser overlay with an Evilginx phishlet and server-side substitution rules that inject the kit into proxied pages, intercepting usernames, passwords, and session cookies for Microsoft 365. In TA419's campaign, victims passed a Cloudflare Turnstile check behind a fake OneDrive loading screen before being redirected to the attacker-in-the-middle credential phishing page targeting the Microsoft 365/Entra ID OfficeHome application. _Developers securing Microsoft 365 integrations can track emerging credential-phishing techniques via daily.dev._ ### What defense does Proofpoint recommend against attacker-in-the-middle credential phishing like TA419's campaign? Proofpoint recommends that organizations in TA419's target scope adopt phishing-resistant, origin-bound authentication such as passkeys. This defense is suggested because TA419's attacker-in-the-middle technique can intercept passwords and session cookies even past traditional multi-factor authentication, making credential-only or OTP-based MFA insufficient against this threat. _Teams weighing passkeys versus traditional MFA against AitM phishing can find practical guidance on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft), [#anthropic](https://daily.dev/tags/anthropic), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/suspected-chinese-spies-spoofed-an-anthropic-exec-ex-white-house-official-in-ai-phishing-wx4wtoums) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Suspected Chinese spies spoofed an Anthropic exec, ex-White House official in AI phishing","url":"https://daily.dev/posts/suspected-chinese-spies-spoofed-an-anthropic-exec-ex-white-house-official-in-ai-phishing-wx4wtoums","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/suspected-chinese-spies-spoofed-an-anthropic-exec-ex-white-house-official-in-ai-phishing-wx4wtoums"},"datePublished":"2026-10-01T16:45:29.837Z","dateModified":"2026-10-05T16:24:45.949Z","description":"A China-aligned espionage group tracked as TA419 impersonated a senior Anthropic employee, a former White House Office of Science and Technology Policy...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dd34910cfdbdc2d5df6ab9eb6821377a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dd34910cfdbdc2d5df6ab9eb6821377a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/suspected-chinese-spies-spoofed-an-anthropic-exec-ex-white-house-official-in-ai-phishing-wx4wtoums","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,microsoft,anthropic,phishing","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Suspected Chinese spies spoofed an Anthropic exec, ex-White House official in AI phishing"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/suspected-chinese-spies-spoofed-an-anthropic-exec-ex-white-house-official-in-ai-phishing-wx4wtoums#faq","mainEntity":[{"@type":"Question","name":"What is TA419 and what phishing technique did it use against AI policy experts?","acceptedAnswer":{"@type":"Answer","text":"TA419 is a China-aligned espionage group that impersonated a senior Anthropic employee and a former White House Office of Science and Technology Policy official to phish AI policy experts at US think tanks, universities, and law firms. Starting July 2026, it used attacker-in-the-middle phishing built on open source Frameless BitB, combining a Browser-in-the-Browser overlay with an Evilginx phishlet to steal Microsoft 365 usernames, passwords, and session cookies via the OfficeHome application. Security teams tracking nation-state phishing tactics like TA419's can follow related coverage on daily.dev."}},{"@type":"Question","name":"How does the Frameless BitB phishing kit steal Microsoft 365 credentials?","acceptedAnswer":{"@type":"Answer","text":"Frameless BitB combines a Browser-in-the-Browser overlay with an Evilginx phishlet and server-side substitution rules that inject the kit into proxied pages, intercepting usernames, passwords, and session cookies for Microsoft 365. In TA419's campaign, victims passed a Cloudflare Turnstile check behind a fake OneDrive loading screen before being redirected to the attacker-in-the-middle credential phishing page targeting the Microsoft 365/Entra ID OfficeHome application. Developers securing Microsoft 365 integrations can track emerging credential-phishing techniques via daily.dev."}},{"@type":"Question","name":"What defense does Proofpoint recommend against attacker-in-the-middle credential phishing like TA419's campaign?","acceptedAnswer":{"@type":"Answer","text":"Proofpoint recommends that organizations in TA419's target scope adopt phishing-resistant, origin-bound authentication such as passkeys. This defense is suggested because TA419's attacker-in-the-middle technique can intercept passwords and session cookies even past traditional multi-factor authentication, making credential-only or OTP-based MFA insufficient against this threat. Teams weighing passkeys versus traditional MFA against AitM phishing can find practical guidance on daily.dev."}}]} ```