iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Proofpoint says the China-aligned group TA419 impersonated a senior Anthropic employee in February 2026 to approach a U.S. think-tank AI policy analyst, using an email about military integration of Anthropic’s Claude models as the pretext. The approach led to an adversary-in-the-middle (AitM) credential-phishing chain. In July, the group used similar policy-themed outreach while impersonating other public figures.
What did the Anthropic impersonation involve?
In a report published October 1, 2026, Proofpoint said TA419 sent an email in February impersonating a senior Anthropic employee to an AI policy analyst at a U.S. think tank. The subject line was “Request for Feedback on Military Integration of Claude,” a plausible invitation amid debate about military uses of Anthropic’s Claude models. Proofpoint says the campaign led to a similar AitM credential-phishing chain. Its report does not identify the employee or the think tank.
The email’s significance was not an attachment or an obvious malware lure. It invoked a credible professional topic and the apparent identity of a relevant company employee to start a conversation that could make a later link seem legitimate.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesHow did the July campaigns work?
Proofpoint described more detail about campaigns that began July 8, 2026. TA419 impersonated Lynne Edwards Parker, formerly Principal Deputy Director of the White House Office of Science and Technology Policy, and Heidi Crebo-Rediker, an economist and foreign-policy expert. The intended recipients included AI policy experts at U.S. think tanks, universities, and law firms.
#1 Best Overall
The initial messages invited recipients to join a fictitious “AI Policy Advisory Committee” or contribute to a purported Senate Committee on Foreign Relations report about AI export controls and supply chains. After a recipient replied, the impersonator sent a shortened URL framed as further information.
From the link to a fake Microsoft sign-in
According to Proofpoint, the July link redirected through a first-stage domain, driftshare[.]co, and then a second-stage domain, globalfileshareplatform[.]com. A filtering page appeared behind a fake OneDrive loading screen before the victim reached an AitM phishing page targeting Microsoft 365 / Entra ID.
Rank #2
The page used a Browser-in-the-Browser overlay to make the proxied login resemble a browser authentication window. Proofpoint says the proxy relayed the genuine Microsoft sign-in flow, allowing the victim’s password and MFA code to pass through while the attacker captured the resulting session cookies. The domains are indicators reported for those campaigns, not proof that they remain malicious today or a complete list of indicators.
Why can an AitM attack work even when someone completes MFA?
In an AitM attack, the phishing site sits between the user and the legitimate sign-in service. The site can relay the real login interaction, including a password and a one-time MFA code, while capturing the authenticated session cookie returned after sign-in. That cookie can let an attacker access a session without simply needing to repeat the same sign-in challenge.
Rank #3
This does not mean every MFA method is equally vulnerable or that every targeted account was compromised. Proofpoint describes the mechanism it observed; its report does not establish how many people completed the flow or how many accounts were taken over. The practical distinction is that a code entered into a convincing but attacker-controlled proxy is not the same protection as phishing-resistant, origin-bound authentication.
What does Proofpoint say about TA419 and its motive?
Proofpoint characterizes TA419 as a China-aligned, espionage-motivated threat actor. It says it had observed targeted credential-phishing campaigns against people at U.S. and Japan-based think tanks, defense contractors, universities, and law firms since at least April 2025. Proofpoint describes the AI-policy targeting as consistent with the group’s existing interest in defense, national security, energy, international relations, and foreign policy, writing that “The targeting of AI policy experts represents an extension of that remit rather than a departure from it.”
Proofpoint assesses that the activity likely supports broader Chinese intelligence objectives around U.S. AI policy and regulation, and expects the group likely to keep targeting policy experts and impersonating real subject-matter figures. Those are Proofpoint’s assessment and forecast; the report does not provide independent proof of state tasking. The dates describe observed activity, not its overall scale: the report gives no standalone victim count or campaign success rate.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →How can AI policy experts and organizations reduce the risk?
Verify an unexpected approach independently
If an unsolicited message proposes a committee, report, interview, or other professional collaboration, verify it through a separate channel you already trust. For example, contact the purported sender using established organizational contact details rather than replying to the message or relying on its link. Proofpoint specifically recommends independent verification of unexpected communications.
Use phishing-resistant authentication where supported
Proofpoint recommends phishing-resistant, origin-bound authentication such as passkeys. Organizations should confirm that their identity provider and the particular accounts being protected support the chosen method, and plan enrollment and account recovery. A compatible FIDO2/WebAuthn hardware security key can be one physical way to implement phishing-resistant authentication, but Proofpoint does not name or endorse a particular key.
Respond promptly if credentials may have been entered
If you submitted credentials or an MFA code on a page reached from unexpected outreach, notify your organization’s security or IT team promptly. Because the reported chain sought session cookies as well as sign-in credentials, responders should assess active sessions and follow their identity-provider procedures for revoking sessions and securing the account; changing a password alone may not address an already captured session.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
