Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
TA419 reportedly approached U.S. AI policy experts with plausible invitations under trusted names, then sent credential-stealing links only after some recipients replied. Proofpoint says the July 2026 campaign impersonated former White House science and technology official Lynne Edwards Parker and later foreign-policy expert Heidi Crebo-Rediker. The sequence matters: an apparently relevant conversation can be the opening stage of a phishing attempt, not proof that a later link is safe.
How the fake policy invitations worked
In a report published October 1, 2026, Proofpoint says the campaign began July 8 and targeted AI policy specialists at U.S. think tanks, universities, and law firms. The lures invited recipients to join a fictitious “AI Policy Advisory Committee” or contribute to a purported Senate Committee on Foreign Relations report about AI export controls and supply chains. The messages were attributed first to Lynne Edwards Parker, formerly Principal Deputy Director of the White House Office of Science and Technology Policy, and later to Heidi Crebo-Rediker, an economist and foreign-policy expert. Proofpoint’s account of the campaign identifies the lures and the impersonated names.
Engagement came before the credential link
Proofpoint describes the opening messages as benign conversation starters. After a target replied, the sender followed up with a shortened URL, presented as a way to view more information. That ordering can make a request feel like a natural continuation of a professional exchange; it does not authenticate the sender or destination.
The link imitated file sharing and Microsoft sign-in
According to Proofpoint, the link used a multi-stage redirect. An actor-controlled first page showed a fake OneDrive loading screen and a Cloudflare Turnstile check before sending the visitor to an adversary-in-the-middle credential-phishing page. The campaign targeted Microsoft 365 / Entra ID and used a customized version of the open-source Frameless BitB Browser-in-the-Browser tool, which can make a deceptive sign-in window resemble a legitimate browser prompt.
#1 Best Overall
Proofpoint reported that the July campaigns shared the first-stage domain driftshare[.]co and second-stage domain globalfileshareplatform[.]com. These are defanged, report-era indicators; their appearance in the report does not establish that the domains or infrastructure remain active.
Other reported impersonation and the attribution
Proofpoint also reports a separate February 2026 campaign impersonating a senior Anthropic employee. It targeted a U.S. think-tank AI policy analyst with a message titled “Request for Feedback on Military Integration of Claude.” Proofpoint says that campaign used a similar adversary-in-the-middle credential-phishing chain.
Rank #2
Proofpoint tracks the actor as TA419, characterizes it as China-aligned and espionage-motivated, and says it has observed the group targeting people at U.S.- and Japan-based think tanks, defense contractors, universities, and law firms since at least April 2025. The company interprets the AI-policy targeting as an extension of TA419’s reported interests in defense, national security, energy, international relations, and foreign policy. Those are Proofpoint’s attribution and assessment, not independently established facts in the campaign description.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Separately, a 2025 FBI alert describes malicious messages impersonating senior U.S. officials and using topics familiar to recipients to build rapport. The alert provides context for this broader tactic; it does not link those campaigns to TA419. Read the FBI alert.
How to assess an unexpected policy invitation
A convincing name or subject is not enough to establish that an invitation is genuine. In this campaign, the subject matter was tailored to the recipient’s work, and the credential link reportedly arrived after an exchange had begun. Treat the request and the link as separate things to verify.
- Confirm the person through another route. Use a contact method you obtain independently, such as an established institutional directory or a previously known address—not contact details or verification links in the message.
- Be wary of shortened links. If a message claims to share a report or committee materials, ask the sender to identify the document through a verified channel rather than following an unexpected URL.
- Do not treat a familiar interface as proof. A OneDrive-style screen, a CAPTCHA or Turnstile check, or a Microsoft-looking sign-in prompt can be imitated. Check the actual site origin before entering credentials, and stop if the address or authentication flow is unexpected.
- Use phishing-resistant authentication where available. Proofpoint recommends considering origin-bound methods such as passkeys. These can help prevent credentials from being replayed on a lookalike site, but no single control eliminates phishing risk.
If you opened the link or entered credentials
Opening a page is not the same as entering credentials, and Proofpoint’s report does not establish that every recipient was compromised. If you entered a work password or approved an unexpected sign-in, contact your organization’s IT or security team promptly through a known channel. Follow its process for securing the account and reviewing sign-in activity; do not rely on a link or phone number in the suspicious message. If you only opened the page, close it and report the message to the appropriate security team so it can assess the event.
Rank #4
What the report does—and does not—establish
Proofpoint’s account explains the reported approach, impersonations, and technical chain, but it gives no campaign victim count, success rate, or total impact figure. It also does not establish that the reported infrastructure remains online. Its forecast that TA419 will continue targeting policy experts and real subject-matter identities is an assessment, not a guarantee about future activity.
Quick Recap
Best Value
- This fun, nerdy, geeky, retro Cybersecurity Awareness Month design is perfect to wear this October. Great for cyber security professionals and experts who keep people safe on the internet, safe online, and safe online.
- Wear this for October National Cyber Security Awareness Month this October, raise awareness about cyber security on smartphones, laptops at your school, in the classroom or on your college or university campus. Be safe online and make sure others are too!
- Lightweight, Classic fit, Double-needle sleeve and bottom hem
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
