Proofpoint reported that a China-aligned espionage group has been impersonating a former White House official and a prominent economist to gain access to the cloud accounts of AI policy experts in the United States. The group is tracked by Proofpoint researchers under the moniker TA419.
Mark Kelly, a threat intelligence analyst at Proofpoint, said that in July 2026, TA419 impersonated multiple individuals—including a former member of the White House Office of Science and Technology Policy leadership—in credential phishing campaigns targeting AI policy experts in the US.
A four-step attack vector
Beginning on July 8, 2026, TA419 started by impersonating Lynne Edwards Parker, former principal deputy director of the White House Office of Science and Technology Policy, and subsequently Heidi Crebo-Rediker, an economist and foreign policy expert. Earlier, in February 2026, the group had impersonated a senior Anthropic employee to target an AI policy analyst at an American think tank. The email bore the subject line “Request for Feedback on Military Integration of Claude,” directly referencing debates surrounding the US military’s use of Anthropic’s Claude model.
The campaign was structured in four stages. The initial email was entirely benign, containing no malicious links, and invited the target to join a bogus “AI Policy Advisory Committee” or contribute to a Senate Foreign Relations Committee report on AI export controls and supply chains. The invitation read naturally and professionally, displaying no signs of an attack at that stage.
If the target replied, the group followed up with a shortened link presented as supplementary documentation. This link led to a phishing page masquerading as OneDrive, designed to harvest the victim’s cloud credentials.
Why the technique works
The most notable aspect lies in the technical implementation. The phishing page is not a static replica. When the user clicks on the document, or when OneDrive prompts for a login, a simulated Chrome login window opens directly within the page, rendered using Frameless BitB, an open-source tool that draws a browser within a browser.
Crucially, the credentials are forwarded to legitimate Microsoft servers. This means passwords, two-factor authentication codes, and conditional access checks all function normally. The attackers do not need to bypass authentication; they simply position themselves in the middle.
The toolkit also includes a dedicated script that reports the victim’s progress, granting attackers a live view of the login session, automatically accepting “Keep me signed in” prompts, and submitting one-time passcodes as soon as they become valid. It is designed to capture the session cookie generated at the end of the authentication flow—a cookie sufficient to maintain account access without requiring the password again.
In terms of infrastructure, TA419 utilized Cloudflare to obscure its real backend IP addresses, frequently registered domains through NameSilo, and often used themes mimicking file-sharing platforms. The group also registered domains spoofing specific organizations, including lookalikes for the Heritage Foundation, the Taiwan-Japan Relations Association, and a site masquerading as the official portal of Japan’s Minister of Defense.
The objective is intelligence
Proofpoint emphasized at the conclusion of its report that this activity likely serves Chinese intelligence objectives aimed at gaining deeper insight into US AI policy and regulatory developments. Nowhere in the report is there mention of malware deployment or establishing persistent footholds.
Proofpoint also noted that it has tracked TA419 conducting credential phishing operations against think tanks, defense contractors, universities, and law firms across the US and Japan since at least April 2025.
The broader context was also highlighted in the report: Proofpoint noted that this activity unfolds amidst intense strategic competition, allegations of model knowledge transfer, and escalating export controls between the US and China. Microsoft’s 2026 Digital Defense Report similarly argued that AI has tilted the short-term advantage toward attackers.
The most insidious aspect of this campaign is that it targets the exact demographic most inclined to engage: experts with legitimate reasons to respond to an invitation to contribute to an AI policy report. Such a request raises few suspicions because it is precisely the kind of inquiry they expect to receive.