TA419: AitM phishing against AI policy experts

On 1 October 2026 Proofpoint published the first public report on TA419, a group it considers China-aligned. According to the researchers, since at least April 2025 the group has been running credential theft campaigns against people working at think tanks, universities, law firms and defence contractors in the United States and Japan. In 2026 its focus shifted to people working on artificial intelligence policy.

The most relevant technical aspect is the technique: an adversary-in-the-middle (AitM) login page that relays the Microsoft 365 sign-in in real time. Password, MFA code and conditional access checks all succeed, and the attacker keeps the session cookies.

What happened

The campaigns follow a patient social engineering pattern:

• February 2026: TA419 posed as a senior Anthropic employee to contact an AI policy analyst at a US think tank, with the subject line “Request for Feedback on Military Integration of Claude”;
• from 8 July 2026: emails in the name of Lynne Parker, former principal deputy director of the White House Office of Science and Technology Policy, and then of Heidi Crebo-Rediker, an economist and foreign policy expert, sent to a larger number of experts at think tanks, universities and law firms. According to The Register, most of the activity took place in July.

The first message contains nothing malicious: it is an invitation to join a non-existent “AI Policy Advisory Committee” or to contribute to a Senate Foreign Relations Committee report on AI export controls and supply chains. Dark Reading stresses that the group builds seemingly legitimate professional relationships. Only those who reply receive the malicious link.

According to Proofpoint, the campaigns most likely serve to gather intelligence on how US AI policy and regulation are developing, amid US-China rivalry over export controls and model distillation. Proofpoint expects the group, already active in defence, national security, energy and foreign policy, to keep impersonating real experts.

Technical details

Attack chain, reconstructed by cross-checking the sources:

1. an outreach email from a sender impersonating a real person, with no links or attachments;
2. after the reply, a shortened URL that goes through several redirects to an attacker-controlled domain;
3. a Cloudflare Turnstile check hidden behind a fake OneDrive loading screen, which keeps scanners and sandboxes away;
4. the AitM login page, acting as a reverse proxy to Microsoft 365 / Entra ID through the first-party OfficeHome application (client_id 4765445b-32c6-49b0-83e6-1d93765276ca).

Phishing kit: it is based on Frameless BitB, a public kit that draws a fake browser window inside the page (Browser-in-the-Browser), with an Evilginx phishlet to intercept Microsoft 365 usernames, passwords and session cookies, and server-side rules that inject the kit into the proxied pages. TA419 added its own module that tracks where the victim is in the sign-in flow, automatically ticks “Keep me signed in” to extend the life of the stolen session, and submits one-time codes as soon as they are accepted.

Infrastructure and public indicators:

• July 2026 campaigns: driftshare[.]co (first stage) and globalfileshareplatform[.]com (second stage);
• domains themed around file sharing and cloud services, such as msfile[.]online and onecloudfilesync[.]com;
• domains imitating organisations: Japan-Taiwan Exchange Association (tw-koryu[.]org), Heritage Foundation (heritiages[.]org, heritiage[.]org), the website of Japanese Minister of Defense Shinjirō Koizumi (shinjirou[.]info);
• backends hidden behind Cloudflare’s CDN. Proofpoint’s report lists dozens of other 2026 domains and addresses, with their registration dates.

MITRE ATT&CK (mapping from the reported facts): T1656 (Impersonation), T1566.002 (Spearphishing Link), T1583.001 (Acquire Infrastructure: Domains), T1557 (Adversary-in-the-Middle), T1111 (Multi-Factor Authentication Interception), T1539 (Steal Web Session Cookie), T1550.004 (Use Alternate Authentication Material: Web Session Cookie).

Impact for European and Italian companies

The sources do not mention victims in Europe. The technique, however, is not specific to the United States: it works against any Microsoft 365 tenant protected by a password and traditional MFA (SMS, code or push app). In Europe, with the AI Act and the debate on export controls, research centres, universities, law firms and defence suppliers working on these topics share the same profile as the targets.

For NIS2 entities the case directly concerns Article 21, which lists multi-factor authentication among the required measures: MFA that can be relayed by a proxy reduces risk far less than it seems. A compromised account with access to email and documents can turn into an incident that must be notified to the national CSIRT (in Italy, CSIRT Italia at ACN).

What to do right now

1. Move to phishing-resistant MFA: passkeys or FIDO2 keys, bound to the origin, which do not work on a domain other than the legitimate one. This is Proofpoint’s main recommendation. Start with executives, researchers and people with a public profile.
2. Block the indicators: add the published domains to DNS, proxy and email filters, and search for them in the logs of recent months.
3. Hunt for stolen sessions: in Entra ID sign-in logs, check sign-ins to the OfficeHome application from unusual addresses or networks, persistent sessions created right after a successful sign-in, and the same token being used from different locations.
4. If you find a compromised account: revoke all sessions and refresh tokens, reset the credentials, check the registered MFA methods and any recently created mailbox rules.
5. Strengthen conditional access: require managed or compliant devices for email and documents, so a stolen cookie is useless from an external machine.
6. Train exposed people: unsolicited outreach from an expert, even credible and without links, can be the first stage of an attack. Verify it through an independent channel, for example a phone number you already know.

How ARXDOME helps

ARX Expose flags lookalike domains registered by others and company accounts involved in breaches, two typical ingredients of these campaigns. ARX Horizon enriches every event with threat lists and lets you search for indicators of compromise from the portal. ARX Sentry collects server and firewall logs and groups sign-ins, bursts of attempts and account changes in the SOC pages.

Last updated: 5 October 2026