TA419 Impersonates Officials and Anthropic Staff to Phish US AI

🕵️ RESEARCH & DEEP DIVES

• China-Aligned TA419 Impersonates Officials and Anthropic Staff to Phish US AI Policy Experts
  Proofpoint reports that China-aligned espionage group TA419 ran credential phishing campaigns impersonating officials, economists, and an Anthropic employee to target US AI policy experts.
  • Targets are AI policy experts at US think tanks, universities, and legal sector organizations; TA419 has hit US- and Japan-based think tanks, defense contractors, universities, and law firms since at least April 2025.
  • Campaigns impersonated Lynne Edwards Parker (former White House OSTP principal deputy director), economist Heidi Crebo-Rediker, and a senior Anthropic employee, luring targets with invites to a fake 'AI Policy Advisory Committee' or AI export control report.
  • Attack flow: benign rapport-building emails, then shortened URLs through multi-stage redirect chains (driftshare[.]co to globalfileshareplatform[.]com) to a fake OneDrive sign-in page after a Cloudflare Turnstile check.
  • Phishing pages use a customized open-source Frameless BitB kit with added telemetry that proxies live Microsoft 365 logins, capturing passwords, MFA codes, and session cookies while victims see a successful sign-in.
  • Proofpoint assesses the activity supports Chinese intelligence gathering on US AI policy and regulation amid US-China competition over export controls and model distillation.
  Sources 📄 Source: proofpoint.com · 📎 Coverage: gbhackers.com · 👁 via The Hacker News

🔓 CVEs & KEV

• CVE-2026-105134 — Ahsay AhsayCBS — CVSS 9.3 — Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injectionA ...

• CVE-2026-103514 — WPScan WP 2FA — CVSS 7.5 — WP 2FA before 4.1.0 - Two-Factor Authentication Bypass via TOTP Code ReplayThe WP ...

• CVE-2026-85568 — WPScan Unlimited Elements for Elementor — CVSS 6.8 — Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQLi via ...

• CVE-2026-85015 — WPScan Unlimited Elements for Elementor — CVSS 6.6 — Unlimited Elements For Elementor before 2.0.21 - Authenticated Arbitrary File Writ...

• CVE-2026-92923 — WPScan Unlimited Elements for Elementor — CVSS 6.3 — Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_...