PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchProofpoint says the TA419 group used professional-sounding AI policy invitations to draw U.S. experts into conversations, then sent links to fake Microsoft sign-in pages designed to steal credentials and session cookies. The campaigns impersonated policy figures in July 2026 and a senior Anthropic employee in February.
Who was targeted, and when?
Proofpoint reports that TA419 began a series of campaigns on July 8, 2026, aimed at AI policy experts at U.S. think tanks, universities and law firms. It also identified a separate campaign from February.
As an Amazon Associate I earn from qualifying purchases.
| Timing | Impersonated identity | Pretext |
|---|---|---|
| February 2026 | A senior Anthropic employee | A request for feedback on the military integration of Claude |
| Beginning July 8, 2026 | First Lynne Edwards Parker, formerly a principal deputy director at the White House Office of Science and Technology Policy; later economist and foreign-policy expert Heidi Crebo-Rediker | An invitation to a fictitious “AI Policy Advisory Committee” or a request to contribute to a supposed Senate Committee on Foreign Relations report about AI export controls and supply chains |
The messages were tailored to people whose work made the policy topics plausible. In the July campaigns, the sender initially approached targets with benign-seeming professional outreach rather than leading with a sign-in link.
How did the phishing chain work?
- Start a conversation. The impersonator sent an invitation or request related to the recipient’s area of expertise.
- Send a shortened link after a reply. The follow-up presented the link as a way to get more information.
- Redirect through a staged page. Proofpoint says the July chain first showed a fake OneDrive loading screen and a Cloudflare Turnstile check before forwarding the target to a second page.
- Relay the sign-in. The final page used an adversary-in-the-middle (AitM) setup, including a customized version of the open-source Browser-in-the-Browser tool Frameless BitB. It proxied activity to genuine Microsoft infrastructure while showing the user a deceptive sign-in experience.
Proofpoint says the July setup targeted Microsoft 365 / Entra ID through the first-party OfficeHome application and injected malicious scripts. An AitM proxy can capture credentials and session cookies as a user signs in. Because it relays the authentication interaction, this technique can defeat the protection normally offered by a one-time MFA code if the user enters that code into the attacker-controlled flow. Proofpoint describes what the method was capable of doing; that does not establish that a particular account was successfully accessed.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Were accounts compromised?
The public reporting reviewed by CyberScoop did not identify victims or say whether any accounts were compromised. Proofpoint and CyberScoop also provide no victim count, compromise count or success rate. The reported lures and infrastructure show a credential- and session-theft attempt, not a publicly confirmed account takeover.
What does “China-linked” mean in this report?
Proofpoint characterizes TA419 as China-aligned and espionage-motivated, and assesses that the activity likely supports broader Chinese intelligence objectives, including understanding U.S. AI policy and regulation. That is the security firm’s assessment, not proof of government direction. CyberScoop notes that Proofpoint did not directly link the operation to the Chinese government.
Rank #2
- FIDO2 + FIDO U2F certified and supported USB security key
- Secured by NXP semiconductors
- Works in every browser and application without installing any drivers
- Supports desktops, laptops, tablets via USB-A and/or NFC, and supports iOS/Android Phones via NFC
- Helps protect your accounts from phishing and other cyber-attacks. Prevents your devices from unauthorized use.
How can AI policy experts and organizations reduce the risk?
- Verify unexpected outreach independently. If a message from a colleague, policymaker or organization asks for a reply or document access, confirm it through a separate, trusted channel rather than using contact details or links in the message.
- Be cautious with follow-up links. A conversation that begins as ordinary professional networking can still be the setup for a later credential request. Check the destination carefully and reach Microsoft services through a known route when possible.
- Use phishing-resistant authentication. Proofpoint recommends origin-bound authentication such as passkeys for organizations in the scope of the activity. Administrators should select methods compatible with their identity environment and policies; no single authentication control eliminates every risk.
- Respond quickly to suspected exposure. Contact the organization’s IT or security team using its established reporting channel. If credentials or an authentication code were entered on a suspicious page, report that detail promptly so responders can assess the account and its active sessions.
Proofpoint says TA419 has conducted targeted credential-phishing campaigns against people at U.S.- and Japan-based think tanks, defense contractors, universities and law firms since at least April 2025. It describes the AI-policy targeting as an extension of the group’s broader interest in defense, national security, energy, international relations and foreign policy.
Quick Recap
Best Value
- SECURITY KEY FOR ENTERPRISE ACCESS: Supports FIDO2 passkeys and U2F for secure authentication across enterprise IT systems.
- PHISHING-RESISTANT AUTHENTICATION: Enables passwordless login with secure on-device credential storage and PIN-based user verification.
- COMPATIBLE WITH ENTERPRISE SYSTEMS: Works with FIDO2, WebAuthn, and U2F across enterprise, cloud, and modern IT environments.
- DRIVERLESS FIDO2 AUTHENTICATION: FIDO2 works natively with modern browsers and platforms. No drivers required.
- USB AND NFC CONNECTIVITY: Supports authentication via USB-C and NFC. No batteries required.
Rank #4
- FIDO2 SECURITY KEY: A versatile, tamper-evident USB-C authentication device with sensitive presence detection for online security. FIDO 2.0 level 1 and U2F certified
- PASSWORDLESS CONVENIENCE: Replace frustrating passwords with a simple 4-digit PIN for accessing apps and sites. Seamlessly login to web apps and Windows sessions
- BROAD COMPATIBILITY: Works with Windows, Mac, Linux, Apple, iOS, iPhone, Android and USB-C devices. Seamlessly integrates with Identity Providers or Credential Management Systems supporting FIDO2, including Thales, Microsoft, AWS, and Google
- ENHANCED USER ADOPTION: Features a sensitive presence detector on the USB key, providing ease of use and superior security. Certified for U2F and FIDO2, ideal for individuals who want to secure access to their personal online accounts - Microsoft, Google, Twitter, Facebook, GitHub
- THALES: We offer a wide range of FIDO authenticators, providing robust, phishing-resistant MFA that comply with stringent regulations. With almost three decades of experience, Thales is a pioneer in passwordless authentication devices, supported globally by the FIDO Alliance and industry analysts
Rank #3
- FIDO2 + FIDO U2F certified and supported USB security key
- Supports Computers, Laptops, Tablets, and Mobile Devices with a USB-C port and/or NFC
- Works without downloading any drivers. Supported OS: Android, Chrome OS, Windows, MacOS, Linux
- Durable design made to last for a long time with everyday use. Water-resistant (IP67)
- Helps protect your accounts from phishing and other cyber-attacks. Prevents your devices from unauthorized use.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
