China-Aligned TA419 Uses Fake OneDrive Pages to Target US AI Policy Experts
Summary
Proofpoint says China-aligned TA419 impersonated policy figures to phish US AI experts, using fake OneDrive pages and browser-in-the-browser techniques to steal Microsoft credentials, MFA codes, and session cookies.
Key points
- TA419 ran credential-phishing campaigns targeting US AI policy experts in July 2026, and impersonated a senior Anthropic employee in a separate February campaign.
- The group posed as former White House officials and other prominent figures, inviting targets to fictitious AI policy and export-control discussions.
- After targets replied, follow-up messages directed them to fake OneDrive pages through a group-controlled domain and a Cloudflare Turnstile check.
- A browser-in-the-browser login window relayed credentials to Microsoft and captured passwords, MFA codes, and session cookies.
- The phishing kit let attackers monitor login progress and submit one-time codes, with captured session cookies providing access to victims’ accounts.
- Proofpoint says TA419 commonly uses Cloudflare to obscure hosting IP addresses and registers domains through NameSilo; lookalike domains impersonated organizations including the Heritage Foundation and Japan-Taiwan Exchange Association.
- Proofpoint assesses the activity likely supports Chinese intelligence objectives related to US AI policy and regulation.
Article Details
- Attack Vectors
- TA419 impersonated former White House and policy figures in emails inviting US AI policy experts to fictitious advisory or policy discussions; after a target replied, the group sent a shortened link leading to a fake OneDrive sign-in flow.
- The phishing page used a fake Chrome login window built with Frameless BitB to capture Microsoft credentials, MFA codes, and session cookies.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | heritiage[.]org | Lookalike domain registered by TA419 to impersonate the Heritage Foundation. |
| DOMAIN | heritiages[.]org | Lookalike domain registered by TA419 to impersonate the Heritage Foundation. |
| DOMAIN | shinjirou[.]info | Domain registered by TA419 to mimic the official website of Japanese Defense Minister Shinjirō Koizumi. |
| DOMAIN | tw-koryu[.]org | Domain registered by TA419 to impersonate the Japan-Taiwan Exchange Association. |
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe fake OneDrive flow used a browser-in-the-browser login window to capture credentials and MFA codes.T1539 · Steal Web Session CookieThe phishing kit was designed to capture session cookies created after login to enable access to victims' accounts.T1566.002 · Spearphishing LinkTA419 followed up email conversations with shortened links leading to fake OneDrive credential-phishing pages.
People
Heidi Crebo-RedikerEconomist and foreign policy expert impersonated by TA419 in a phishing campaign.Lynne Edwards ParkerFormer White House Office of Science and Technology Policy official impersonated by TA419 in a phishing campaign.Mark KellyProofpoint threat intelligence analyst who described the campaigns.
Threat Actors
Vendors
CloudflareTA419 used Cloudflare, NameSilo, and lookalike domains tied to organizations such as the Heritage Foundation and the Japan-Taiwan Exchange Association.NameSiloTA419 used Cloudflare, NameSilo, and lookalike domains tied to organizations such as the Heritage Foundation and the Japan-Taiwan Exchange Association.ProofpointA China-aligned espionage group has been posing as a former White House official and a prominent economist to get into the cloud accounts of AI policy experts in the US, Proofpoint have found.
Products
ClaudeThat email carried the subject line “Request for Feedback on Military Integration of Claude”, a reference to the debate over the US military’s use of Anthropic’s Claude models.Google ChromeClicking a document, or OneDrive’s own prompt to sign in, opens a fake Chrome login window drawn inside the page with Frameless BitB, an open-source browser-in-the-browser tool.Microsoft OneDriveThe operation used fake OneDrive login pages, browser-in-the-browser tricks, and cloud infrastructure to steal Microsoft credentials, session cookies, and access to victim accounts.