TA419: Reply-Gated Lures and a Fake Sign-In Window That Steal Microsoft 365 Sessions from AI Policy Experts
TA419 won replies from AI policy experts, then sent a link to a browser-in-the-browser page that relays the real Microsoft 365 login and keeps the session cookie.
AegisAI Threat IntelligenceAegisAI Threat Watch · Browser-in-the-browser phishing
TA419: Reply-Gated Lures and a Fake Sign-In Window That Steal Microsoft 365 Sessions from AI Policy Experts
A China-aligned actor opened with trust-building emails, then used a fake browser window to relay real Microsoft 365 sign-ins and capture session cookies.
Analysis based on 1 October 2026 reporting by The Register, CyberScoop and Infosecurity Magazine on research into the actor TA419. The original research report is not linked; every fact below is cited to these outlets or to a standards or documentation page.
TA419 won a reply with a trust-building email, then sent a link to a fake OneDrive page that relays the real Microsoft 365 sign-in and keeps the session cookie. The targets were AI policy experts at US think tanks, universities and law firms.
The login itself was genuine, so the password, the MFA prompt and the Conditional Access checks all passed on Microsoft's side. What the attacker gained was an authenticated session. The reporting does not say whether any account was actually taken.
Sources: The Register (8 July start, the three identities, the "dozens" of domains) and Infosecurity Magazine (activity since at least April 2025).
Key judgments
- The risk sits in the sequence, not the first email. The opening message did not immediately ask for a password or point to a sign-in page, and the link came only after the target replied; in AegisAI's assessment, a control that judges each message alone sees an ordinary exchange until the second step.
- The sign-in is real, which is why MFA does not stop it. The proxy passes the password, the MFA response and the Conditional Access checks to Microsoft and keeps the session that comes back, so the attacker holds a session rather than a password.
- The fake browser window is the disguise; the relay behind it is the mechanism. TA419 also added its own module that follows each victim through the Microsoft login, ticks "Keep me signed in" and enters one-time codes the moment they are accepted.
- The infrastructure is built to look routine. Domains are themed on file sharing and cloud storage, sit behind Cloudflare's content delivery network, and a Cloudflare Turnstile check hides behind a fake OneDrive loading screen. Domain lists age quickly, so the pattern is the durable signal.
- The reporting stops short of impact. No victims are named, no account compromise is confirmed, and the activity is not formally tied to the Chinese government.
How does spear phishing reach policy experts when the first email has no sign-in link?
The campaigns opened with a conversation. The lures invited targets to join a fake AI policy advisory committee, or to contribute to a Senate foreign relations committee report on AI export controls and supply chains. CyberScoop reports that the initial messages did not immediately request passwords or direct recipients to a sign-in page.
The phishing link arrived only after a target replied. It was a shortened link that purported to share more information, and it led through several redirects to a spoofed OneDrive sign-in page.
- The actor sends a short invitation in the name of a real, identifiable person.
- The target replies.
- The actor answers with a shortened link said to hold more information.
- The link passes a Cloudflare Turnstile check behind a fake OneDrive loading screen.
- The target lands on a fake sign-in window that relays the real Microsoft 365 login.
Who the lures pretended to be
From 8 July 2026 the emails spoofed a former principal deputy director of the White House Office of Science and Technology Policy, and then an economist and foreign policy expert. In February 2026 a different lure used a senior Anthropic employee, with the subject line "Request for Feedback on Military Integration of Claude", sent to an AI policy analyst at a US think tank. The Register notes that email arrived as US military officials pressured Anthropic to remove Claude's safeguards, so, in AegisAI's assessment, the lure rode a live policy dispute.
The targets sit in a narrow group: AI policy experts at US think tanks, universities and law firms. Infosecurity Magazine adds that the actor has also targeted defense contractors in the US and Japan since at least April 2025.
The login was genuine and the session was taken. Every check on Microsoft's side passed because the victim really did pass them.
AegisAI Threat IntelligenceHow does browser-in-the-browser phishing steal a Microsoft 365 session after MFA?
A browser-in-the-browser (BitB) page draws a fake browser window inside the web page itself, so a sign-in prompt that is only HTML looks like a separate, legitimate popup. The kit TA419 used is Frameless BitB. Its README describes it as a way to build the BitB effect without iframes, designed to work with Evilginx and a Microsoft phishlet, and notes that framebuster scripts target iframes.
The Register reports that the kit combines a BitB overlay, an Evilginx phishlet that intercepts usernames, passwords and session cookies for Microsoft 365, and server-side substitution rules. The chain targets Microsoft 365 and Entra ID through the first-party OfficeHome application. Because the sign-in happens against Microsoft's real servers, Infosecurity Magazine reports, the password entry, the MFA prompt and the Conditional Access check all complete normally, and the attacker takes the session cookie.
What TA419 added to the open-source kit
Infosecurity Magazine reports that TA419 attached its own module to monitor where each victim is in the login process. The module ticks "Keep me signed in" automatically, so the stolen session lasts longer, and enters one-time codes the moment they are accepted. CyberScoop describes the tool as a modified version of Frameless BitB. In AegisAI's assessment, these changes automate the steps an operator would otherwise take by hand during a live relay.
What does TA419 infrastructure look like?
The Register reports that the July 2026 campaigns used driftshare[.]co as the first-stage domain and globalfileshareplatform[.]com as the second-stage domain. The first-stage page runs a Cloudflare Turnstile check behind a fake OneDrive loading screen and then redirects to the credential page. TA419 typically uses Cloudflare's content delivery network to hide the backend hosting IP address.
The actor also themes domains on file sharing and cloud storage, such as msfile[.]online and onecloudfilesync[.]com, and registers lookalikes of real organizations. These include the Japan-Taiwan Exchange Association, the Heritage Foundation and the official website of Japan's defense minister; CyberScoop adds a lookalike of the World Economic Forum. In total the actor uses dozens of phishing and spoofed-sender domains, plus phony email addresses.
| Indicator (defanged) | Type | Reported use |
|---|---|---|
driftshare[.]co | Domain | First-stage redirect, July 2026 |
globalfileshareplatform[.]com | Domain | Second-stage page with the relay, July 2026 |
msfile[.]online | Domain | File-sharing themed |
onecloudfilesync[.]com | Domain | Cloud-storage themed |
tw-koryu[.]org | Domain | Lookalike of the Japan-Taiwan Exchange Association |
heritiages[.]org, heritiage[.]org | Domains | Lookalikes of the Heritage Foundation |
shinjirou[.]info | Domain | Lookalike of the website of Japan's defense minister |
client_id=4765445b-32c6-49b0-83e6-1d93765276ca | Application ID | The first-party OfficeHome application the chain targets |
Subset reported by The Register; the actor uses many more domains. Treat these as historical indicators, not a live blocklist. The application ID names a legitimate Microsoft application, so in AegisAI's assessment it appears in ordinary sign-ins too and a match alone proves nothing.
Why standard controls miss it
Each layer a defender usually leans on sees something that looks normal.
- Message scanning. The opening email asked for nothing and linked to no sign-in page. The link appeared only in a later reply.
- Link scanning. The chain runs through a shortened link, redirects and a Cloudflare Turnstile check. In AegisAI's assessment, a scanner that cannot pass the check is shown the check, not the credential page.
- MFA and Conditional Access. Both run against Microsoft's real servers and both succeed, because the relay forwards the victim's own answers.
- Token binding. Microsoft documents token protection as generally available for native applications on Windows, iOS and macOS, with browser support limited to selected web apps that access Azure Resource Manager. On that documented coverage, a cookie captured from a browser sign-in sits outside it today.
The researchers quoted in the reporting recommend phishing-resistant, origin-bound authentication such as passkeys. Microsoft's built-in Phishing-resistant MFA strength in Conditional Access is built on methods that require an interaction between the authentication method and the sign-in surface: a FIDO2 security key, Windows Hello for Business or a platform credential, or multifactor certificate-based authentication.
How AegisAI protects against it
The lures in this campaign were emails: the opening message and the reply that carried the shortened link. The approach below applies to both.
Aegis does not classify infrastructure. It classifies intent. A lure with no attacker-owned infrastructure still has to ask the recipient to do something on the attacker's behalf, and that request is what gets classified, independent of how clean the destination URL is.
AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it.
When a lure or a compromised session is caught, the response compounds: the message is withheld at classification, copies already delivered are retracted, rewritten links refuse a late visit, the account's outbound and internal mail gets rescanned, and lateral phishing attempts to colleagues are blocked at the same bar rather than treated as a fresh, unrelated message.
More on how that works: inbound email security.
What the reporting does not tell us
Impact. CyberScoop reports that the research did not identify victims or state whether any accounts were compromised, so the success rate of the campaigns is unknown.
Attribution. The reporting does not directly link the activity to the Chinese government. Infosecurity Magazine reports the researchers' view that the campaigns likely feed Chinese intelligence gathering on US AI policy and regulation; that is an assessment, not a finding.
The first email. The reporting says the opening messages did not immediately ask for a password or point to a sign-in page. It does not say whether those messages contained no links at all.
Scale. No count of emails or targets is published in the three articles. The Register notes the full indicator list sits in the original research; the table above is a subset.
Duration. Activity is dated from at least April 2025, but the reporting documents named waves only in February and July 2026.
MITRE ATT&CK mapping
| ID | Name | Use in this campaign |
|---|---|---|
T1566.002 | Phishing: Spearphishing Link | A shortened link was sent after the target replied to the opening message. |
T1557 | Adversary-in-the-Middle | A Frameless BitB relay sat between the victim and the real Microsoft sign-in. |
T1539 | Steal Web Session Cookie | The relay captured the session cookie issued after the genuine sign-in. |
T1078.004 | Valid Accounts: Cloud Accounts | A captured session would give access to the Microsoft 365 account; the reporting does not confirm any account was accessed. |
Mapping by AegisAI from the behavior described in the reporting. The reporting itself does not publish ATT&CK IDs.
Recommendations for defenders
- Require phishing-resistant sign-in for the people in scope. Use a Conditional Access authentication strength that requires the built-in Phishing-resistant MFA strength for policy, research, legal and executive staff first. Policies are evaluated after the initial authentication, so a password can still be entered but the session cannot proceed without a phishing-resistant method.
- Treat unsolicited subject-matter outreach as a possible pretext stage. Brief high-risk groups that an invitation from a known name can be the first step, and require independent verification of the sender before replying with anything or following a link sent afterwards.
- Inspect reply threads, not only first messages. Flag shortened links that appear in a reply to an external sender and resolve through a bot check or a loading-screen redirect before a Microsoft sign-in page.
- Review Entra sign-in logs for the targeted application. Look for sessions against the first-party OfficeHome application from an unfamiliar device or location shortly after a normal MFA completion. The application is legitimate, so treat a match as a lead to confirm, not a verdict.
- Plan for the token binding gap. Evaluate token protection where it applies, and pair it with phishing-resistant sign-in, because browser sessions are largely outside its documented coverage.
FAQ
What is browser-in-the-browser (BitB) phishing?
Browser-in-the-browser phishing draws a fake browser window inside a web page, so an HTML overlay looks like a separate, legitimate sign-in popup. In the TA419 campaigns the overlay came from the open-source Frameless BitB kit, as The Register and Infosecurity Magazine reported.
How does adversary-in-the-middle phishing bypass MFA?
It does not defeat MFA directly; it relays it. The phishing page forwards the victim's password and one-time code to Microsoft's real authentication service in real time, so the login succeeds, and the attacker takes the session cookie issued afterwards. Passwords, MFA prompts and Conditional Access checks all complete normally.
How can an organization protect executives and policy experts from targeted spear phishing like this?
Require phishing-resistant sign-in such as passkeys or FIDO2 security keys, which the researchers in the reporting recommend. Add independent verification of unsolicited outreach, and inspect reply threads and shortened links, because the phishing link in this campaign arrived only after the target replied.
Who is TA419, and were any accounts compromised?
TA419 is a China-aligned group the reporting says has targeted think tanks, defense contractors, universities and law firms in the US and Japan since at least April 2025. The reporting does not identify victims or say whether any accounts were compromised, and it does not directly link the activity to the Chinese government.
References
- The Register (1 Oct 2026). Suspected Chinese spies spoofed an Anthropic exec, ex-White House official in AI phishing. theregister.com
- CyberScoop (1 Oct 2026). AI policy circles targeted in China-linked phishing operation. cyberscoop.com
- Infosecurity Magazine (1 Oct 2026). China-Linked Hackers Impersonate AI Experts to Target US Policy. infosecurity-magazine.com
- Frameless BitB project README (GitHub). Description of the kit, used here only to explain how it differs from iframe-based BitB. github.com
- MITRE ATT&CK. T1566.002 Spearphishing Link; T1557 Adversary-in-the-Middle; T1539 Steal Web Session Cookie; T1078.004 Cloud Accounts. attack.mitre.org
- Microsoft Learn. Overview of Conditional Access authentication strengths. learn.microsoft.com
- Microsoft Learn. How token protection enhances Conditional Access policies. learn.microsoft.com
Related posts
More from the AegisAI blog.