PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteProofpoint says the China-aligned group TA419 impersonated a senior Anthropic employee in February 2026 to approach a U.S. think-tank AI policy analyst, then used an adversary-in-the-middle phishing chain designed to steal Microsoft account credentials and session cookies. In July, the group impersonated other policy figures in campaigns targeting AI experts. Proofpoint assesses the activity as likely connected to Chinese intelligence interest in U.S. AI policy; that is the security firm’s assessment, not independently established proof of state tasking.
What happened in the Anthropic impersonation
In a report published October 1, 2026, Proofpoint said TA419 sent a February email to an AI policy analyst at a U.S. think tank while posing as a senior Anthropic employee. The subject line was “Request for Feedback on Military Integration of Claude,” a plausible invitation tied to debate over military use of Anthropic’s Claude models. Proofpoint says the approach led to a similar adversary-in-the-middle (AitM) credential-phishing chain. It did not identify the employee or the think tank.
As an Amazon Associate I earn from qualifying purchases.
The Anthropic-themed message was one part of a broader effort to reach people working on AI policy. In more fully described campaigns beginning July 8, TA419 posed as two public-policy figures: Lynne Edwards Parker, formerly Principal Deputy Director of the White House Office of Science and Technology Policy, and economist and foreign-policy expert Heidi Crebo-Rediker.
How the July phishing campaigns built credibility
Targets included AI policy experts at U.S. think tanks, universities, and law firms. The initial messages proposed professional-sounding collaboration: joining a fictitious “AI Policy Advisory Committee” or contributing to a purported Senate Committee on Foreign Relations report about AI export controls and supply chains.
#1 Best Overall
After a recipient replied, the impersonator sent a shortened URL presented as further information. That sequence used a conversation about policy work to make the link feel like a natural next step rather than an unexpected attachment or generic login request.
How the fake OneDrive page could steal an account
Proofpoint describes a multi-stage chain. A first page displayed a fake OneDrive loading screen and acted as a filter; a second, actor-controlled domain hosted an AitM credential-phishing page. The July campaigns targeted Microsoft 365 / Entra ID sign-ins. A Browser-in-the-Browser overlay made the proxied sign-in resemble a browser authentication window.
- The target followed the link. A shortened URL redirected through the campaign’s infrastructure to the staged sign-in experience.
- The page relayed a real sign-in flow. Rather than simply collecting a password on a static fake form, the AitM proxy relayed the genuine Microsoft sign-in process, according to Proofpoint.
- The attacker could capture credentials and session material. As the user entered a password and MFA code, the proxy could pass them through and capture resulting session cookies. A stolen authenticated session can let an attacker act as the user without asking them to enter a new code at that moment.
This explains why completing a one-time MFA prompt does not necessarily protect against AitM phishing: the victim may be authenticating to the real service through an attacker-controlled proxy, which captures the session established by that authentication. Proofpoint describes the observed mechanism, but its report does not establish how many people completed the flow or whether every targeted account was compromised.
What the reported domains do—and do not—tell you
Proofpoint identified driftshare[.]co as a first-stage domain and globalfileshareplatform[.]com as a second-stage domain in the July campaigns. These are historical indicators reported for that activity, not confirmation that the domains remain malicious today or a complete blocklist. The report’s technical description is available from Proofpoint Threat Research.
What Proofpoint says about TA419 and its likely motive
Proofpoint characterizes TA419 as a China-aligned, espionage-motivated threat actor. The company says it had observed targeted credential-phishing against people at U.S.- and Japan-based think tanks, defense contractors, universities, and law firms since at least April 2025, and describes the group’s earlier activity as not previously publicly reported.
Proofpoint interprets the AI-policy targeting as an extension of the group’s interest in defense, national security, energy, international relations, and foreign policy. It assesses that the campaigns likely support broader Chinese intelligence objectives concerning U.S. AI policy and regulation, and predicts continued targeting of policy experts through impersonation of real subject-matter figures. Those statements are Proofpoint’s attribution and assessment; the report does not provide independent proof of state tasking.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How AI policy experts and organizations can reduce risk
Verify unexpected professional outreach
- Treat unsolicited invitations involving policy committees, reports, or expert feedback as requests that need verification, even when the sender’s name and topic seem credible.
- Confirm the sender and the proposed collaboration through an independent channel—such as a known phone number or an address found separately—not by replying to the message or using its link.
- Before signing in, check the destination and authentication context. A familiar-looking OneDrive or Microsoft sign-in screen is not proof that the page is operated by Microsoft.
Use phishing-resistant authentication
Proofpoint recommends phishing-resistant, origin-bound authentication such as passkeys. For an organization, confirm that its identity provider and account policies support the chosen method, and plan enrollment and recovery so users do not fall back to weaker sign-in methods. A compatible FIDO2/WebAuthn hardware security key is one possible physical implementation, but Proofpoint does not name or endorse a product; check provider and organizational compatibility before selecting a key.
Respond promptly if credentials may have been entered
If someone used a link in an unexpected message to sign in, they should alert their organization’s security team through its established reporting channel. Because this chain was designed to capture session cookies as well as credentials, responders should assess and revoke active sessions as well as address exposed passwords, following the organization’s identity-provider procedures.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
