Plan
active
China-Aligned TA419 Targets U.S. AI Policy Experts With AitM Phishing
- Engineer — Plan: AitM phishing bypasses authenticator-app MFA; audit whether high-value Microsoft accounts have phishing-resistant (FIDO2) MFA enabled and review Conditional Access token-binding policies to reduce session-hijack risk.
- SOC/IR — Plan: The AitM-against-M365 technique warrants tuning detections for anomalous OAuth token issuances and Conditional Access bypass patterns; build a hunt targeting users in AI/policy roles for suspicious sign-in behavior since no IOCs were published.
- Leader — Learn: China-nexus espionage group targeting AI policy think tanks, universities, and legal firms is useful sector-awareness context; no immediate action unless your organization operates in AI policy research or adjacent legal advisory work.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.