US AI policy specialists
How they got in, as reported. Email made to look like it came from a trusted sender.
← All cases- Date
- 1 Oct 2026
- Place
- United States
- Who
- US AI policy specialists
- The way in
- Email impersonation
- Source
- Infosecurity Magazine
What was reported.
A China-aligned threat group tracked as TA419 targeted AI policy experts at US think tanks, universities, and law firms using impersonation and credential phishing. The attackers sent emails posing as known experts with fake invitations leading to adversary-in-the-middle reverse proxies that intercepted Microsoft 365 credentials and MFA sessions.
The way in the source reports: email made to look like it came from a trusted sender.
From July 8, the attackers sent emails in the name of Lynne Parker, who served as principal deputy director of the White House Office of Science and Technology Policy, and later economist and foreign policy expert Heidi Crebo-Rediker.Infosecurity Magazine, added to these pages on 2 Oct 2026. The source
What forged email is.
Forged email is a message that shows a trusted sender's name or address while someone else sent it. The receiving server decides whether to deliver it. It follows what the real domain publishes about its own mail.
Attackers use it where a message moves money or opens a door: a changed bank detail on an invoice, a request to approve a payment, a link to a page that asks for a password. The message reads as routine because it arrives under a name the reader already trusts.
We read the records a domain publishes for its mail: whether it has a DMARC record, what that record tells receivers to do with a forged message and which services its SPF record names as senders. Those records are public and anyone can check them.
A reading of public records cannot see a message that was sent or received, the rules inside a mailbox or whether a person replied to a forgery. It shows whether the domain tells receivers to refuse mail forged in its name.
This part is true of every case of this kind. It says nothing more about US AI policy specialists than the source does.
What we check for it.
Whether anyone can send mail that passes as your domain.
If this happens at your firm.
- Treat an email from a colleague that asks for a payment or a password as unconfirmed until you have spoken to them.
- Tell your clients how your firm confirms bank details, so a forged email that asks otherwise stands out.
- Confirm any request to pay or to change bank details on a number you already hold, never one in the email.
What we read for law firms.
- The records that tell inboxes whether to refuse email sent as you (DMARC, SPF and DKIM).
- Names made from yours, each asked whether it is registered and set up for mail.
- Breach records for addresses at your own domain.
- The mail records of every other domain your firm owns.
- The certificate your website answers with: its name, its dates and who issued it.
- The headers and cookies your website sends to every visitor.
The rule, from its source: What does ABA Model Rule 1.6(c) ask a lawyer to do about client information?
See your own firm the way an attacker reads it.
We read your domain from public records and show each way in with a check anyone can re-run.
Source.
Source: Infosecurity Magazine ↗This page repeats what the source reported, with its date. It says nothing about any firm that is not named in it.