China-aligned TA419 phishes US AI policy experts through a proxy that captures Microsoft session cookies

Standard MFA fails here because of where the proxy sits. The adversary-in-the-middle page relays the victim's login to Microsoft as it happens. The victim types the password and clears the second factor against the real sign-in page, and the proxy keeps the session cookie Microsoft issues ^[4]. That cookie is a bearer token: whoever holds it is signed in, with no further challenge. A second factor entered during that login does not change the outcome, because it was spent on the genuine site at the moment the victim typed it. Proofpoint says the sign-in looks normal and successful, and the victim sees nothing wrong ^[4].

The fix Proofpoint names is a change of credential type: phishing-resistant authentication such as passkeys, with out-of-band verification of unsolicited subject-matter outreach ^[16]. That follows from the cookie. A credential that never produces a replayable secret gives the relay proxy nothing to carry to the real server.

The pretext is chosen to fit the reader. Proofpoint says an AI policy researcher both anticipates and wants to reply to a message seeking their expert input on how the military might use a frontier model, and impersonating a named Anthropic employee or a former OSTP leader lends it credibility a generic lure would lack ^[19].

The final page uses Frameless browser-in-the-browser. Classic BitB draws a fake browser window inside the real one with HTML, CSS and JavaScript and loads the fake sign-in page in an iframe; the frameless version produces the same picture without the iframe, so it drops a common detection anchor ^[13]. Security researcher Wael Masri described the technique in January 2024 as "injecting scripts and HTML besides the original content using search and replace (aka substitutions), then relying completely on HTML/CSS/JS tricks to make the visual effect" ^[14]. Proofpoint reports that TA419 extended this open-source tool ^[15].

TA419's standing interests are defense, national security, energy, international relations and foreign policy ^[17], and Proofpoint calls the move into AI policy "an extension of that remit rather than a departure from it" ^[6]. Proofpoint ties the activity to Chinese intelligence interest in how the US writes AI policy and regulation, a field that now runs through strategic competition, accusations of model distillation, and export controls between the two countries ^[7][18]. The targets brief lawmakers, draft frameworks, and advise on export policy ^[8].