Proofpoint has published research on TA419, a China-aligned espionage group that impersonates well-known AI policy figures to get US researchers onto an adversary-in-the-middle (AitM) Microsoft 365 sign-in page. The kit relays the real Microsoft login, submits one-time codes automatically and keeps the session cookie. If a user can type an MFA code into a page, this kit can take the session.
What happened
On October 1, 2026, Proofpoint's Mark Kelly and the Proofpoint Threat Research Team described campaigns from February and July 2026. According to Proofpoint, the group has been phishing for credentials since at least April 2025, aiming at staff of think tanks, defense contractors, universities and law firms in the US and Japan. This round focused on AI policy experts.
In July 2026, the actor impersonated Lynne Edwards Parker, a former Principal Deputy Director of the White House Office of Science and Technology Policy, and economist Heidi Crebo-Rediker, using freemail accounts on mail.com and outlook.com. The first emails were harmless. They invited targets to join a fictitious "AI Policy Advisory Committee" or contribute to Senate committee reports on AI export controls and supply chains. Phishing links came in follow-up messages. In February 2026, TA419 impersonated a senior Anthropic employee with the subject line "Request for Feedback on Military Integration of Claude" and led targets into a similar AitM chain.
The delivery chain, per Proofpoint:
- A URL shortener points to a first-stage domain behind Cloudflare, which runs a Cloudflare Turnstile check behind a fake OneDrive loading screen.
- The target is then sent to a second-stage AitM page built on a customized copy of Frameless BitB, an open-source browser-in-the-browser kit from GitHub, styled as a OneDrive login.
- The kit targets Microsoft 365 and Entra ID through the first-party OfficeHome application (client ID
4765445b-32c6-49b0-83e6-1d93765276ca) and includes an Evilginx phishlet for Microsoft 365. - Targets see the genuine Microsoft
/common/oauth2/v2.0/authorizeflow, proxied with injected scripts. A customobserve.jsmodule tracks the sign-in, accepts "Keep me signed in" and submits one-time codes as soon as they validate.
Proofpoint lists passwords, MFA codes and session cookies as what the kit captures. It did not report malware in this activity, and it did not say whether any targets were compromised. The post includes indicators: 3 sender email addresses, 19 domains (15 redirect and AitM phishing domains plus 4 sender domains), and a TLS certificate fingerprint from actor VPS hosts using self-signed certificates.
Why it matters
AitM phishing is not new. What stands out is the automation: the script enters the code inside its validity window and picks "Keep me signed in" so the stolen session lasts longer. The result is a valid, MFA-satisfied Microsoft 365 session in someone else's browser. OTP methods do nothing to stop it, because the victim types the code into the relay.
Proofpoint's recommendation is the same one this blog keeps returning to:
Organizations in the scope of TA419 activity should consider phishing-resistant, origin-bound authentication such as passkeys.
Origin binding is the reason. A passkey is scoped to the real Microsoft domain and will not produce a valid assertion for a proxy domain. The pretext also builds trust first: the opening email asks for nothing, so filters and users have little to flag until the follow-up.
What to check in your environment
- Identify the people in scope: policy, research and legal staff who work on AI, export controls or defense topics. Prioritize them for passkey or FIDO2 enrollment.
- Check which MFA methods those users can still use. If OTP or push is accepted next to a passkey, the AitM path stays open. Plan to require phishing-resistant methods for that group.
- Load Proofpoint's published domains, sender addresses and certificate fingerprint into email, proxy and DNS blocklists. Search mail and web logs for past hits.
- Review Entra sign-in logs for in-scope users. Look for successful OfficeHome sign-ins with a persistent session from IP addresses or locations that do not match the user's normal devices, especially after they received unsolicited outreach.
- Make sure your incident playbook for a suspected AitM hit revokes sessions and refresh tokens, not just the password. A password reset alone leaves a stolen session cookie usable until it expires.
- Brief in-scope staff on the pretext. An invitation from a known policy figure on a freemail address, followed by a file-share link, should be verified through a separate channel.