China-Aligned TA419 Targets U.S. AI Policy Experts With AitM Phishing

Sun, 04 Oct 2026 15:46:58 +0000

Engineer — Plan: AitM phishing bypasses authenticator-app MFA; audit whether high-value Microsoft accounts have phishing-resistant (FIDO2) MFA enabled and review Conditional Access token-binding policies to reduce session-hijack risk.
SOC/IR — Plan: The AitM-against-M365 technique warrants tuning detections for anomalous OAuth token issuances and Conditional Access bypass patterns; build a hunt targeting users in AI/policy roles for suspicious sign-in behavior since no IOCs were published.
Leader — Learn: China-nexus espionage group targeting AI policy think tanks, universities, and legal firms is useful sector-awareness context; no immediate action unless your organization operates in AI policy research or adjacent legal advisory work.

China-Espionage on CuraSec