China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing

TA419 Impersonates Policy Figures to Phish AI Experts

Proofpoint has attributed a sustained credential-phishing operation against U.S. AI policy experts to TA419, a China-aligned, espionage-motivated threat actor the firm has tracked since at least April 2025. Beginning July 8, 2026, the group impersonated Lynne Edwards Parker, the former Principal Deputy Director of the White House Office of Science and Technology Policy (OSTP), and later Heidi Crebo-Rediker, a prominent economist and foreign-policy expert, to target staff at U.S. think tanks, universities, and law firms. An earlier wave in February 2026 impersonated AI policymakers and a named Anthropic employee, using a phishing email with the subject line Request for Feedback on Military Integration of Claude to single out an AI policy expert at a U.S. think tank. Victims are lured into a Microsoft OAuth2 / Entra ID adversary-in-the-middle (AitM) kit built on an open-source "Frameless" browser-in-the-browser (BitB) toolkit, designed to harvest credentials, MFA codes, and live session cookies.

Incident Details

Attribute	Value
Threat Actor	TA419 (China-aligned, espionage-motivated)
First Observed	At least April 2025; escalated AI-policy targeting July 2026
Attribution	Proofpoint Threat Research
Targets	U.S. and Japan-based think tanks, universities, law firms, defense contractors
Impersonated Figures	Lynne Edwards Parker (ex-OSTP), Heidi Crebo-Rediker (economist), an Anthropic employee
Identified Recipient	Alex Engler, former White House official, now director of the Penn Center on Media, Technology, and Democracy
Technique	Reply-chain pretexting → shortened URL → Frameless BitB AitM proxy against Microsoft sign-in
Phishing Infrastructure	`driftshare[.]co`, `globalfileshareplatform[.]com` (NameSilo-registered, Cloudflare-fronted)
Toolkit Basis	Open-source Frameless BitB (GitHub project `waelmas/frameless-bitb`)
Data Targeted	Microsoft 365 / Entra ID credentials, MFA codes, session cookies
Assessed Motive	Intelligence collection on U.S. AI policy and export-control deliberations

How the Campaign Worked

Stage 1 — Trust-building outreach. TA419's initial emails carried no malicious links at all. Instead, they invited recipients to join a fictitious "AI Policy Advisory Committee" or to contribute to a purported Senate Committee on Foreign Relations report on AI export controls and supply chains, borrowing the identities of real, well-known figures in the AI policy space to lend the pretext credibility.

Stage 2 — Reply-chain escalation. Only if the target replied did TA419 send a follow-up message containing a shortened URL, framed as a link to supplementary material for the fabricated committee or report. This reply-gated approach filters out automated scanners and low-value targets while building rapport with the human recipient.

Stage 3 — Multi-stage redirection. The shortened link first resolved to driftshare[.]co, which displayed a fake OneDrive loading screen behind a Cloudflare Turnstile CAPTCHA — both a bot filter and a credibility cue. From there, the chain redirected to globalfileshareplatform[.]com, the domain hosting the actual AitM phishing kit.

Stage 4 — Frameless BitB AitM proxy. Rather than cloning a static login page, the kit operates as a real-time reverse proxy against the genuine Microsoft /common/oauth2/v2.0/authorize endpoint, relaying authentic OAuth2 responses while injecting malicious client-side scripts: a driver script that attaches a Shadow DOM container styled as a OneDrive folder listing, a second script that intercepts document-click interactions to trigger a convincing fake browser window overlay, and a telemetry module that tracks the victim's progress through the login flow. Because the overlay is built from Shadow DOM elements rather than an iframe, it evades many traditional BitB detection heuristics — hence "frameless."

Stage 5 — Session hijack. The proxy auto-accepts "Keep me signed in" prompts and automatically forwards one-time MFA codes as the victim enters them, then captures the resulting session cookie. That cookie lets TA419 access the victim's Microsoft 365 / Entra ID account directly, bypassing the need to replay a password or MFA code and surviving routine credential resets.

Infrastructure and Attribution Notes

Proofpoint tied the campaign's infrastructure together via NameSilo domain registrations fronted by Cloudflare (obscuring backend hosting) and a consistent file-sharing naming theme. Separate email infrastructure, identified through exposed Received headers on actor-controlled VPS servers, shared a self-signed TLS certificate with the distinguished name C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI across multiple campaign waves — a reused artifact that helped researchers cluster otherwise distinct-looking lures. Other 2026 spoofed domains included tw-koryu[.]org (mimicking the Japan-Taiwan Exchange Association), heritiages[.]org and heritiage[.]org (typosquats of the Heritage Foundation), and shinjirou[.]info (impersonating Japan's Minister of Defense), underscoring that TA419's targeting extends beyond the U.S. into Japan-based policy and defense circles.

Proofpoint assesses the campaign "likely supports wider Chinese intelligence objectives to better understand ongoing developments within the U.S. AI policy and regulatory landscape," occurring amid intensified U.S.-China strategic competition, accusations of AI model distillation, and tightening export controls. Notably, researchers frame the operation as targeting policy insight rather than pure technology theft — TA419 wants to know what regulators and advisors are thinking, not just what models can do. The firm also noted this activity sits alongside a separate China-aligned actor, UNK_SweetSpecter, previously observed running comparable AI-themed phishing, and a broader pattern of China-aligned groups targeting semiconductor and rare-earth supply chains that underpin AI development.

Impact Assessment

Impact Area	Description
Credential Exposure	Microsoft 365 / Entra ID usernames, passwords, and MFA codes harvested in real time
Session Hijacking	Captured session cookies grant account access that survives password resets and bypasses standard MFA re-prompts
Intelligence Leakage	Compromised policy-expert mailboxes may expose draft legislation feedback, export-control deliberations, and think-tank communications
Reputational Spoofing	Named real individuals (Parker, Crebo-Rediker, an Anthropic staffer) impersonated without consent, risking confusion and reputational harm
Sector Exposure	Think tanks, universities, law firms, and defense contractors in the U.S. and Japan with limited enterprise security staffing relative to typical nation-state targets
Strategic Risk	Feeds Chinese intelligence insight into U.S. AI regulatory and export-control direction during an active policy window

Recommendations

For Think Tanks, Universities, and Law Firms

Enforce phishing-resistant, origin-bound authentication such as FIDO2/WebAuthn passkeys for all Microsoft 365 / Entra ID accounts, particularly for staff engaged in AI policy, export-control, or government-adjacent work.
Deploy conditional access policies that flag or block sign-ins following atypical token-replay patterns, and monitor for session tokens reused from new IP ranges or devices shortly after authentication.
Block or alert on outbound clicks to newly registered, Cloudflare-fronted domains using file-sharing naming conventions (e.g., -share, -platform, -drive), and specifically flag driftshare[.]co and globalfileshareplatform[.]com.

For Security Teams

Hunt for anomalous Entra ID sign-in logs showing OAuth2 authorization-code grants immediately followed by activity from unfamiliar user agents or ASNs — a hallmark of AitM session theft.
Review mail-flow logs for messages referencing fictitious advisory committees, Senate Foreign Relations AI/export-control reports, or unsolicited invitations tied to AI policy work, especially those impersonating known public figures.
Treat the self-signed certificate distinguished name C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI and the waelmas/frameless-bitb toolkit fingerprint as hunting leads across email gateway and proxy logs.

For Individual Targets (Policy Staff, Researchers, Advisors)

Treat unsolicited subject-matter outreach — invitations to advisory committees, requests for feedback on policy drafts, or offers to contribute to reports — as a plausible pretext stage, even when it appears to come from a known or respected name.
Verify unexpected communications through an independent channel (a known phone number or separate email thread) before clicking any link, especially one that arrives only after you reply to an initial, link-free message.
Watch for login flows that visually resemble Microsoft OneDrive/Entra ID but load inside an unusual overlay, request MFA twice, or auto-check "Keep me signed in" without prompting.

Key Takeaways

TA419 is a China-aligned, espionage-motivated actor active since at least April 2025, now escalating operations against U.S. and Japan-based AI policy experts.
The group impersonates real, named individuals — including a former White House OSTP official and an Anthropic employee — to build credibility before sending any malicious link.
The core tradecraft is a reply-chain pretext followed by a Frameless BitB adversary-in-the-middle kit that proxies genuine Microsoft OAuth2 traffic to steal credentials, MFA codes, and session cookies.
Stolen session cookies let attackers bypass password resets and routine MFA, making detection reliant on sign-in anomaly monitoring rather than credential-strength controls alone.
Proofpoint assesses the motive as policy and regulatory insight, not just technical IP theft — TA419 wants visibility into U.S. AI export-control and governance deliberations.
Phishing-resistant authentication (passkeys) and independent-channel verification of unsolicited policy outreach are the most effective mitigations against this specific tradecraft.