China-Linked TA419 Hackers Target US AI Policy Experts With Credential Phishing Attacks

A China-linked threat actor known as TA419 has targeted U.S. artificial intelligence policy specialists through highly customized credential-phishing operations.

This campaign, which involves impersonation, adversary-in-the-middle infrastructure, and a modified Browser-in-the-Browser toolkit, aims to steal Microsoft 365 sessions.

This activity indicates a focused effort to collect intelligence on individuals who influence U.S. AI regulation, export controls, and national AI strategy.

Recent research by Proofpoint has revealed that TA419, motivated by espionage and aligned with China’s interests, has been executing a targeted phishing campaign against AI policy experts affiliated with U.S. think tanks, universities, and law firms.

This activity was observed in July 2026 and included meticulously crafted emails impersonating prominent figures such as economists, former U.S. government officials, and AI industry professionals.

Starting on July 8, TA419 impersonated Lynne Edwards Parker, the former Principal Deputy Director of the White House Office of Science and Technology Policy, and economist and foreign-policy expert Heidi Crebo-Rediker.

The emails invited recipients to join a fictitious “AI Policy Advisory Committee” or contribute to a purported Senate Committee on Foreign Relations report concerning AI export controls and supply-chain issues.

Instead of using immediate malicious attachments or links, the campaign employed a relationship-building approach. TA419 first sent benign-looking outreach messages to prompt a reply.

Once a target responded, the attackers shared shortened URLs claiming to provide additional details, ultimately directing victims to a counterfeit Microsoft OneDrive sign-in page designed to harvest cloud credentials and authenticated sessions.

The phishing scheme utilized a multi-stage redirection chain that began with URL shortening services and adversary-controlled domains. The first-stage domain, driftshare[.]co, displayed a fake OneDrive loading screen and conducted a Cloudflare Turnstile check before forwarding victims to globalfileshareplatform[.]com, the final phishing site.

This phishing infrastructure specifically targeted Microsoft 365 and Entra ID users through the legitimate OfficeHome OAuth application. Rather than simply collecting passwords, the operation proxied the victim’s live authentication session to Microsoft’s infrastructure.

This enabled the attackers to capture passwords, multi-factor authentication (MFA) codes, and pass conditional-access checks while making it appear the victims were successfully logged in, allowing potential account takeovers.

Proofpoint highlighted that the phishing pages were constructed using a customized version of Frameless BitB, an open-source Browser-in-the-Browser framework.

TA419 enhanced this with telemetry and automation scripts that monitored victims throughout the Microsoft login process, automatically accepted “Keep me signed in” prompts, and submitted one-time MFA codes once validated.

This method is particularly dangerous as it can circumvent the protections typically offered by traditional MFA when victims are misled into completing authentication through an attacker-controlled reverse proxy.

The operations in July followed a previous campaign in February 2026, in which TA419 impersonated a senior employee from Anthropic and sent a message to an AI policy analyst titled “Request for Feedback on Military Integration of Claude.”

This lure referenced ongoing debates about the military applications of AI systems, showcasing the actor’s strategy of using timely and relevant policy themes.

Proofpoint has been tracking TA419’s targeting of U.S. and Japan-based think tanks, defense contractors, universities, and law firms since at least April 2025.

The firm assesses that the focus on AI policy reflects Chinese intelligence’s interest in U.S. regulatory perspectives, AI export controls, defense integration, and strategic technology policies, rather than mere technology theft.

IoC

Indicator	Type	Description	First Seen
leparker@mail[.]com	Email address	Attacker-controlled sender address	July 2026
hcrediker@mail[.]com	Email address	Attacker-controlled sender address	July 2026
hcrediker@outlook[.]com	Email address	Attacker-controlled sender address	July 2026
driftshare[.]co	Domain	First-stage redirect domain	July 2026
globalfileshareplatform[.]com	Domain	Second-stage AitM phishing domain	July 2026
quickfly[.]online	Domain	First-stage redirect domain	May 2026
smartsyncbox[.]com	Domain	Second-stage AitM phishing domain	May 2026
cirrushare[.]co	Domain	First-stage redirect domain	April 2026
mypublicshare[.]com	Domain	Second-stage AitM phishing domain	March 2026
goshshare[.]online	Domain	First-stage redirect domain	March 2026
synchvault[.]co	Domain	First-stage redirect domain	March 2026
cloudsyncpulse[.]com	Domain	Second-stage AitM phishing domain	March 2026
onecloudfilesync[.]com	Domain	Second-stage AitM phishing domain	February 2026
msfile[.]online	Domain	First-stage redirect domain	February 2026
winsync[.]cloud	Domain	First-stage redirect domain	February 2026
publicsharefile[.]cloud	Domain	Second-stage AitM phishing domain	February 2026
fileswiftonline[.]cloud	Domain	Second-stage AitM phishing domain	December 2025
sharehub[.]space	Domain	First-stage redirect domain	December 2025
tw-koryu[.]org	Domain	Spoofed sender domain	May 2026
heritiages[.]org	Domain	Spoofed sender domain	March 2026
heritiage[.]org	Domain	Spoofed sender domain	March 2026
shinjirou[.]info	Domain	Spoofed sender domain	February 2026
b314a1499cd728ca3e54b7150661fd0c7d2279065fe3f570f0f66c395d744460	TLS certificate SHA-256	Certificate associated with suspected TA419 anonymization infrastructure; subject/issuer includes O=Castro Inc	February 2026

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC