TA419

China-Aligned TA419 Conducts AitM Phishing Against U.S. AI Policy Experts

A China-nexus threat actor identified as TA419 (also tracked as FamousSparrow) has been conducting credential phishing campaigns targeting U.S. AI policy experts, think tank researchers, university academics, and legal sector personnel. The campaigns use Microsoft Account-to-Account (AitM) phishing infrastructure to bypass multi-factor authentication and harvest credentials. Threat actors impersonated prominent economists, AI policymakers, and a prominent Anthropic employee to increase the effectiveness of their lures. The activity has been ongoing through at least October 2026. Microsoft recommends enabling phishing-resistant MFA and implementing conditional access policies as primary mitigations.