A China aligned espionage group, tracked by Proofpoint as TA419, is running targeted credential phishing campaigns against AI policy experts at US and Japanese think tanks, universities, defense contractors, and law firms. Since at least April 2025, the threat actor group has impersonated high profile figures, including a senior Anthropic employee to, invite targets to join a fake “AI Policy Advisory Committee” or contribute to a Senate foreign relations report on AI export controls and supply chains. If a victim replies, TA419 sends a shortened URL that leads through Cloudflare Turnstile and a fake OneDrive loading screen to an adversary in the middle (AitM) page built on the Frameless BitB kit and Evilginx phishlets. The reverse proxy forwards Microsoft 365/Entra ID logins in real time, capturing usernames, passwords, MFA codes, and session cookies, and automatically ticking “Keep me signed in” to extend session life. TA419 hides its infrastructure behind Cloudflare and uses dozens of file sharing themed and impersonation domains (driftshare[.]co, globalfileshareplatform[.]com). Proofpoint assesses the activity as intelligence gathering on US AI policy and broader defense and foreign policy issues. CTIX Analysts recommend phishing resistant, origin bound authentication (such as passkeys) and independent verification of unsolicited subject matter outreach.