Proofpoint exposes TA419 phishing campaign impersonating White House officials to target AI policy experts

TA419 impersonates well-known figures to target AI policy circles

According to Proofpoint’s research report, the group tracked by Proofpoint as TA419 launched multiple rounds of credential phishing operations in July 2026, impersonating several well-known economists and AI policymakers. The targets were AI experts working at US think tanks, universities and legal institutions.

The campaign began on Jul 8, 2026. TA419 first impersonated Lynne Edwards Parker, former deputy director of the White House Office of Science and Technology Policy, before switching to impersonate renowned foreign policy expert Heidi Crebo-Rediker. The hackers first sent seemingly harmless emails inviting targets to join a fabricated ‘AI Policy Advisory Committee’ or contribute to a Senate Foreign Relations Committee report on AI export controls and supply chains, building trust to lure replies.

Once a target replied, TA419 sent a shortened URL with multiple redirects, ultimately leading to a fake OneDrive adversary-in-the-middle (AitM) credential phishing page. The page used a browser-in-the-browser (BitB) technique adapted from the open-source tool Frameless BitB, targeting Microsoft 365 and Entra ID accounts. The report notes the group also impersonated a senior Anthropic employee in February this year, targeting a think tank AI policy analyst.

Antino backdoor targets government agencies in eight Asian countries

According to a report by The Record citing Cisco Talos, another campaign run by a China state-backed group used a backdoor called Antino to breach government agencies in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar and Syria. Cisco’s incident response team found that between September 2025 and July 2026, 16 organisations across eight Asian countries were affected or targeted, with around 350 infected endpoints recorded.

The Antino backdoor allows hackers to conduct reconnaissance, transfer files and maintain access, aimed at intelligence gathering. Most victims were initially compromised through phishing emails and decoy documents, including news reports about the Trump administration, invitations impersonating real events, and legislative documents. Cisco Talos also noted overlap with Symantec’s Jewelbug research.

Jewelbug runs espionage operations alongside cryptocurrency fraud

Symantec’s threat hunter team report states that Jewelbug (also known as Earth Alux, REF7707, CL-STA-0049) is a China-based hacking-for-hire group that simultaneously runs espionage operations targeting governments and militaries in the Middle East, Southeast Asia and South Asia, as well as a cryptocurrency fraud business targeting Chinese-speaking users. Both operations are managed by the same small team on the same infrastructure, coordinated through a browser-based control panel called XG-Web.

The report says the group’s commercial activities are linked to a registered company in Hunan. Jewelbug’s victim database recorded over one million implant check-ins and more than 580,000 stolen browser cookies within an active period of less than three months. Its main implant is a malicious browser extension disguised as ‘PDF Viewer’, alongside Linux and router implants called ClientKing.