> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Chinese spies impersonate White House, Anthropic figures to phish AI policy experts - URL: https://f4n6.co.uk/security-feed/chinese-spies-impersonate-white-house-anthropic-figures-to-phish-ai-policy-experts/ - Published: 2026-10-02T11:46:36.000Z - Updated: 2026-10-02T11:46:36.000Z - Author: Jeff Davies - Tags: #security-feed, TA419 ## 1\. Executive summary A China-aligned espionage group tracked by Proofpoint as TA419 ran credential phishing campaigns in July 2026 against US-based AI policy experts, impersonating a former White House Office of Science and Technology Policy official and an economist to win trust before delivering an adversary-in-the-middle (AitM) phishing page. The kit uses the open-source Frameless BitB browser-in-the-browser tool to draw a fake Chrome login window, relays credentials to Microsoft's servers so MFA and conditional access checks pass, and captures the resulting session cookies. The group has no MITRE ATT&CK profile in our reference data, so the China-aligned attribution is single-sourced to Proofpoint and remains unconfirmed. No CVE, CVSS score or CISA KEV entry applies: this is a social-engineering and session-theft campaign, not a software vulnerability. The direct risk to EMEA financial services is low today, but the technique set (AitM session-cookie theft that defeats MFA) is directly reusable against Microsoft 365 estates, and the targeting of policy and regulatory staff is a pattern that maps onto government-affairs, regulatory-liaison and public-policy functions inside banks. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 18 | TA419's AitM kit captures session cookies that defeat MFA and conditional access, so a successful hit on a regulated entity's cloud account is an ICT-related incident whose classification depends on whether the actor gained an authenticated session rather than merely a password. | Classification must account for session-token compromise, not just credential exposure. A stolen cookie that grants mailbox or document access is a materially different incident from a phished password that was blocked by MFA. | | NIS2 Art. 23 | The campaign targets policy and regulatory staff, and a compromised mailbox at an in-scope entity would trigger the incident reporting clock. | If an in-scope EMEA entity is hit, the 24-hour early warning and 72-hour incident notification timelines run from awareness, and the AitM session theft is the fact that determines whether the threshold is met. | No other article in the regulatory reference is engaged by this item. DORA Art. 17, 19, 24, 28, 29 and 30 and NIS2 Art. 21(2)(d) are not triggered by the facts here: there is no third-party ICT provider failure, no concentration finding, no testing obligation and no supply-chain compromise in the source material. ## 3\. Technical analysis & attack chain Confirmed steps, as reported by Proofpoint via Help Net Security: 1. TA419 sent an initial email with no malicious link or attachment. The email invited the target to join a fictitious "AI Policy Advisory Committee" or to contribute to a Senate Committee on Foreign Relations report on AI export controls and supply chains. 2. If the target replied, TA419 followed up with a shortened URL that purported to share additional information. 3. The link resolved to a domain controlled by the group, which presented a fake OneDrive loading screen backed by a Cloudflare Turnstile check. 4. Passing the Turnstile check sent the target to a second domain hosting the phishing page, which displayed a OneDrive folder listing with lure documents. 5. Clicking a document, or OneDrive's own sign-in prompt, opened a fake Chrome login window drawn inside the page using Frameless BitB, an open-source browser-in-the-browser tool. 6. Credentials entered in that window were relayed to Microsoft's servers, so the password, the MFA code and conditional access checks all completed successfully. 7. A custom script in the kit reported the victim's progress to the attackers, gave them a live view of the session, accepted the "Keep me signed in" prompt, and submitted one-time codes as soon as they validated. 8. The kit captured the session cookies created at the end of the login, which would give the attackers access to the target's cloud account. ### Impersonation and targeting The July 2026 campaigns began on 8 July 2026\. TA419 first impersonated Lynne Edwards Parker, former Principal Deputy Director of the White House Office of Science and Technology Policy, then Heidi Crebo-Rediker, an economist and foreign policy expert. In February 2026 the group impersonated a senior Anthropic employee to target an AI policy analyst at a US think tank; that email carried the subject line "Request for Feedback on Military Integration of Claude", a reference to the debate over US military use of Anthropic's Claude models. Targets were AI policy experts in the US. ### Infrastructure TA419 consistently uses Cloudflare's content delivery network to obscure the backend hosting IP address for its domains, which are typically registered via NameSilo. The group's credential phishing domains are typically themed around file-sharing sites and cloud services. It occasionally registers domains impersonating specific organisations, including heritiages\[.\]org and heritiage\[.\]org for the Heritage Foundation, tw-koryu\[.\]org for the Japan-Taiwan Exchange Association, and shinjirou\[.\]info, which mimics the official website of Japanese Defense Minister Shinjirō Koizumi. ### Assessment and caveats Proofpoint concluded the activity likely supports wider Chinese intelligence objectives to better understand ongoing developments within the US AI policy and regulatory landscape, and occurs amid strategic competition, accusations of model distillation, and export controls involving the US and China. That motive assessment is single-sourced to Proofpoint. TA419 has no MITRE ATT&CK profile in our reference data, so the China-aligned attribution is unconfirmed and should be treated as a vendor tracking designation rather than a state attribution we can independently support. The domain list above is drawn from a single vendor report; verify before any enforcement action. The source does not name the shortened-URL service, the specific phishing domains used in the July 2026 campaign, the hosting IP addresses, or any file hashes. ## 4\. Mitigation & containment P1 within 24h - Treat any inbound email inviting staff to join an "AI Policy Advisory Committee" or contribute to a Senate Committee on Foreign Relations report on AI export controls as hostile until proven otherwise. These are the exact lures reported. Route them to the phishing mailbox and block at the gateway. - Block the named impersonation domains at DNS and web proxy: heritiages\[.\]org, heritiage\[.\]org, tw-koryu\[.\]org, shinjirou\[.\]info. These are single-sourced; verify against your own telemetry before permanent enforcement. - Enforce token protection and continuous access evaluation for Microsoft 365 where your licence tier supports it. The kit's entire value is the session cookie; binding tokens to the device removes it. - Hunt for anomalous Microsoft 365 sign-ins where the user agent is a browser but the session originated from a hosting or CDN IP range, and for "Keep me signed in" persistence on accounts that do not normally use it. P2 within 72h - Shorten session token lifetime for privileged and policy-facing accounts. The kit accepts the "Keep me signed in" prompt, so long-lived refresh tokens extend the attacker's window. - Require phishing-resistant MFA (FIDO2 or passkeys) for any account with access to regulatory correspondence, government-affairs material or policy documents. AitM kits relay TOTP and push codes; they do not defeat a hardware-bound credential. - Restrict or monitor the use of URL shorteners in inbound mail. The follow-up email in this chain used a shortened URL to hide the destination. - Add conditional access rules that block authentication from Cloudflare-fronted hosting ranges for accounts that never legitimately sign in from them. P3 within 7 days - Brief government-affairs, regulatory-liaison and public-policy staff on the specific pretexts: fake committee invitations, fake Senate report contributions, and impersonation of named policy figures. The first email carries no link, so link-scanners will not catch it. - Review mailbox rules and OAuth grants on policy-facing accounts for changes made in the last 90 days, since session theft is often followed by silent persistence. - Confirm your incident classification process captures session-cookie theft as a distinct scenario under DORA Art. 18, not as a failed phishing attempt. ## 5\. Indicators of compromise | type | value | confidence | source | | ------------- | ------------------------------------------------------ | ---------- | -------------------------------- | | domain | heritiages\[.\]org | medium | Proofpoint via Help Net Security | | domain | heritiage\[.\]org | medium | Proofpoint via Help Net Security | | domain | tw-koryu\[.\]org | medium | Proofpoint via Help Net Security | | domain | shinjirou\[.\]info | medium | Proofpoint via Help Net Security | | email subject | Request for Feedback on Military Integration of Claude | medium | Proofpoint via Help Net Security | The domain set is single-sourced to Proofpoint and is not tied in the source to the specific July 2026 campaign infrastructure. Verify before enforcement. No file hashes, IP addresses, URLs or mailbox addresses were provided. ```iocs domain heritiages[.]org domain heritiage[.]org domain tw-koryu[.]org domain shinjirou[.]info email_subject Request for Feedback on Military Integration of Claude ``` ### Behavioural indicators | behaviour | where to observe | confidence | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------- | ---------- | | Inbound email with no link or attachment inviting the recipient to join an "AI Policy Advisory Committee" or contribute to a Senate Committee on Foreign Relations report on AI export controls | Mail gateway and mailbox audit logs | medium | | Follow-up email containing a shortened URL after the target replies | Mail gateway and mailbox audit logs | medium | | Fake OneDrive loading screen backed by a Cloudflare Turnstile challenge | Web proxy and browser telemetry | medium | | Fake Chrome login window rendered inside a web page (browser-in-the-browser) | Endpoint browser telemetry, EDR | medium | | Authentication that completes MFA and conditional access but originates from a hosting or CDN IP range | Microsoft Entra ID sign-in logs | medium | | "Keep me signed in" accepted on an account that does not normally use it | Entra ID sign-in logs | medium | | One-time codes submitted immediately after they validate | Entra ID authentication method logs | medium | ## 6\. Detection The source gives no file hashes, command lines, mutexes or registry keys, so a file-based YARA rule is not supportable. The usable artefacts are the impersonation domains and the lure subject line, which are network and mail telemetry, so the detection below is a Sigma rule for mail and proxy logs. ```yaml title: TA419 AI Policy Credential Phishing Lures and Impersonation Domains id: 8f3c1a52-7d94-4b1e-9c60-2a5e6f0d1b47 status: experimental description: Detects mail and web telemetry matching the TA419 credential phishing campaign against AI policy experts, including the impersonation domains and the Anthropic-themed lure subject line reported by Proofpoint. author: Adverse Trace date: 2026-10-02 references: - https://www.helpnetsecurity.com/2026/10/02/china-aligned-ta419-phishing-ai-policy-experts/ logsource: category: proxy detection: selection_domain: query|contains: - 'heritiages.org' - 'heritiage.org' - 'tw-koryu.org' - 'shinjirou.info' selection_subject: subject|contains: 'Request for Feedback on Military Integration of Claude' condition: selection_domain or selection_subject falsepositives: - Legitimate traffic to the genuine Heritage Foundation, Japan-Taiwan Exchange Association or Japanese government sites if the lookalike strings are matched loosely. The listed domains are typosquats and should not resolve in normal business traffic. level: medium ``` ## 7\. Sources - Help Net Security, "Chinese spies impersonate White House, Anthropic figures to phish AI policy experts", https://www.helpnetsecurity.com/2026/10/02/china-aligned-ta419-phishing-ai-policy-experts/, 2026-10-02\. Reporting on Proofpoint research by threat intelligence analyst Mark Kelly. ## 8\. Adverse Trace position We assess the direct risk to EMEA financial services clients as low today, because the reported targeting is US AI policy experts and no EMEA victim is named. The technique is the part that matters: an AitM kit that relays credentials to Microsoft, passes MFA and conditional access, and steals the session cookie defeats the control most banks rely on. The China-aligned attribution rests on a single vendor report and TA419 has no MITRE ATT&CK profile in our reference data, so we treat it as unconfirmed. We will monitor for EMEA-facing variants of these lures, particularly against government-affairs and regulatory-liaison staff, and will issue a follow-up if Proofpoint or another vendor publishes the July 2026 campaign domains, hosting IPs or hashes. Clients who see the "AI Policy Advisory Committee" or Senate report pretext in their mail logs should report it to us so we can correlate. --- [Read the original source →](https://www.helpnetsecurity.com/2026/10/02/china-aligned-ta419-phishing-ai-policy-experts/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*