Credential Phishing

Credential phishing is a social engineering attack in which an attacker tricks someone into revealing login details or authentication credentials by impersonating a trusted person or system. These attacks pose a critical compliance risk because compromised credentials give attackers access to sensitive data, proprietary AI models, training datasets, and governance systems without triggering technical security alerts. Organizations must address credential phishing through user training, multi-factor authentication, email monitoring, and clear reporting procedures to meet obligations under frameworks like SOC 2, ISO 27001, and regulatory standards for data protection.

1 item

EnforcementUS2026-10-02

Chinese Espionage Group Spoofed Anthropic Exec to Steal AI Policy Credentials

Security researchers at Proofpoint have identified a China-aligned threat group, designated TA419, running credential phishing campaigns in 2026 against AI policy communities. The attackers impersonated a senior Anthropic employee and former White House science officials to target researchers at US universities, think tanks, and law firms. Victims were lured with fake AI policy committee invitations and tricked into surrendering their Microsoft 365 login credentials.

Anthropic China espionage credential phishing identity security AI policy targeting TA419 export controls