China-aligned TA419 defeats Microsoft MFA by capturing the session after a real login
Proofpoint says China-aligned TA419 has phished US AI policy experts since at least April 2025, defeating MFA by capturing the session after they log in. The sign-in runs on genuine Microsoft infrastructure, so a correct password and a completed MFA prompt both pass without stopping the attacker.
Context for builders, not their beat.
What happened
- The July lures impersonated Lynne Edwards Parker, a former White House science-policy deputy director, and the economist Heidi Crebo-Rediker, inviting targets onto a fictitious advisory committee.
- A February 2026 campaign impersonated a senior Anthropic employee, asking a US think-tank analyst for feedback on the military's use of the company's Claude models.
- Both July campaigns ran through the same two domains, driftshare[.]co then globalfileshareplatform[.]com, the first running a Cloudflare Turnstile check behind a fake OneDrive loading screen before redirecting.
- TA419 also registered domains resembling real organizations, including the Heritage Foundation, the World Economic Forum and the Japan-Taiwan Exchange Association.
Why it matters
- What's now possible capability A completed MFA prompt yields a live session the attacker copies, so accounts behind multi-factor sign-in are still reachable.
- Who's exposed exposure The targeted population is AI policy specialists at US think tanks, universities and law firms, and their cloud accounts are what the operation is after.
- What it limits constraint Because the sign-in runs on real Microsoft infrastructure and behaves like a legitimate login, defenders cannot catch it by inspecting the appearance of the page.
- What doesn't add up contradiction The report does not directly link TA419 to the Chinese government, and China denies conducting espionage, so state sponsorship is Proofpoint's assessment and not an established fact.
The attack works because the victim does the authenticating. Proofpoint says the target who follows TA419's link lands on the genuine Microsoft /common/oauth2/v2.0/authorize page, proxied through an adversary-in-the-middle setup, and enters a password and completes a multi-factor prompt as usual [4]. The group extended its phishing kit with a custom module that tracks and drives the target through the sign-in flow, including the MFA step [4]. Proofpoint said the setup was built to capture account credentials and the active browser session a successful login creates [10]. The MFA code passes, and the session token it produces is copied in transit.
TA419 built the chain on Frameless BitB, an open-source Browser-in-the-Browser kit that pairs a fake browser-window overlay with an Evilginx phishlet for Microsoft 365 [3]. Proofpoint said that in these campaigns the kit presented a fake Microsoft login window over a page that resembled a OneDrive document-sharing site [15].
The approach was patient. The group opened with benign emails themed around AI policy, inviting targets onto a fictitious "AI Policy Advisory Committee" or to contribute to a report on AI export controls, and sent the link only after the target replied [5]. Proofpoint, in research released Thursday, says TA419 has run this kind of campaign since at least April 2025, about 15 months, targeting think tanks, defense contractors, universities and law firms in the US and Japan [2][14][16]. The firm says the activity likely serves Chinese intelligence interest in US AI policy, and it did not identify any victims or say whether an account was taken [9][11].
What to watch
- Whether Proofpoint or any target later discloses a confirmed account takeover, which the current report does not state.
- Whether the same adversary-in-the-middle kit shifts to new infrastructure or new target sectors.
- Whether US authorities move to formally attribute TA419 to the Chinese state.
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
In July 2026, a China-aligned threat actor Proofpoint tracks as TA419 ran multiple credential phishing campaigns impersonating prominent economists and AI policymakers to target AI experts at US think tanks, universities, and legal-sector organizations.
- [2]
Proofpoint has observed TA419 conducting regular targeted credential phishing against individuals at US- and Japan-based think tanks, defense contractors, universities, and law firms since at least April 2025, and says the group's activity had not been previously reported publicly.
- [3]
The phishing chain is built on Frameless BitB, an open-source Browser-in-the-Browser kit that pairs a BitB overlay with an Evilginx phishlet for Microsoft 365 and server-side rules that inject the kit into proxied pages.
- [4]
TA419 extended the kit with a custom telemetry and automation module that tracks and drives the target through the Microsoft sign-in flow, including multi-factor authentication; the page the target lands on is the genuine Microsoft /common/oauth2/v2.0/authorize response.
- [5]
TA419 first sent benign conversation-starter emails themed around AI policy, such as an invitation to join an 'AI Policy Advisory Committee' or to contribute to a report on AI export controls, and sent a link only after the target replied.
- [6]
Beginning 8 July 2026, TA419 impersonated Lynne Edwards Parker, former Principal Deputy Director of the White House Office of Science and Technology Policy, and then Heidi Crebo-Rediker, a prominent economist and foreign policy expert.
- [7]
In February 2026, TA419 impersonated a senior Anthropic employee to target an AI policy analyst at a US think tank, using the subject line 'Request for Feedback on Military Integration of Claude.'
- [8]
Both July 2026 campaigns used the same first-stage domain (driftshare[.]co) and second-stage domain (globalfileshareplatform[.]com); the first conducts a Cloudflare Turnstile check behind a fake OneDrive loading screen before redirecting to the credential-phishing page.
- [9]
Proofpoint says the activity likely supports Chinese intelligence objectives to better understand US AI policy and regulatory developments.
- [10]
Proofpoint said the setup was intended to capture account credentials and active browser sessions; in the adversary-in-the-middle attack the victim interacts with genuine Microsoft infrastructure and may enter a password and complete a multifactor prompt while the attacker captures the session created by the login.
- [11]
The report did not identify victims or state whether any accounts were compromised.
- [12]
The report does not directly link the activity to the Chinese government; China has repeatedly denied conducting cyber espionage while accusing the United States of operations against Chinese interests.
- [13]
TA419 registered domains resembling real organizations, including the Heritage Foundation, the World Economic Forum, and the Japan-Taiwan Exchange Association.
- [14]
Proofpoint released the research on Thursday; the activity comes amid growing US-China competition over AI development, export controls, semiconductor supply chains, and military uses of the technology.
- [15]
Proofpoint said Frameless BitB creates a false browser window within a webpage, and in these campaigns presented a fake Microsoft login window over a page that resembled a OneDrive document-sharing site.
- [16]
About 15 months separate TA419's earliest observed activity, in April 2025, from its July 2026 campaigns against AI policy experts.
Sources & coverage · 2 publishers
The reporting this story was synthesized from, earliest first. Every link goes to the original.
- cyberscoop.comOct 1AI policy circles targeted in China-linked phishing operation | CyberScoop