China-Aligned TA419 Targets U.S. AI Policy Experts With Browser-in-Browser Phishing

A China-aligned threat actor Proofpoint tracks as TA419 conducted credential phishing campaigns in July 2026, impersonating prominent U.S. government officials and AI industry figures to target experts shaping American AI policy. The group sent benign outreach emails inviting targets to join fictional committees or contribute to reports on AI export controls, then followed up with shortened URLs leading to Frameless BitB—a customized open-source browser-in-browser phishing tool—designed to capture Microsoft 365 credentials and session cookies.