According to Proofpoint, TA419 is a China-aligned, espionage-motivated threat actor conducting regular targeted credential phishing campaigns against individuals at US- and Japan-based think tanks, defense contractors, universities and law firms since at least April 2025. In 2026 it impersonated real subject-matter experts, including a former White House OSTP official and a senior Anthropic employee, to target AI policy experts. Benign rapport-building emails are followed by multi-stage URL redirection to an adversary-in-the-middle phishing page against Microsoft 365 / Entra ID, built on a customised Frameless BitB kit embedding an Evilginx phishlet. Proofpoint states the group's activity had not been previously reported publicly.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| Various | TA419 |
No techniques mapped yet.
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names TA419, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to TA419. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy.