Hackers linked to China spent months pretending to be respected AI insiders, including a senior Anthropic employee and a former White House official. Their goal was simple: get AI policy experts to click a link and hand over their Microsoft logins. It is a textbook case of spear phishing, and the tricks they used work just as well on software agencies.

I'm Nitin Kumar, Lead Project Coordinator at Debugged Pro. Our team builds software for clients in India and the USA, and our people hold admin access to a lot of client systems. So when a security report shows attackers getting past normal two-factor login, I read it closely. Here is what happened, how the trap worked and what your team can do about it this week.

Hooded figure sitting in front of computer screens showing code, illustrating a spear phishing campaign — A China-aligned group tracked as TA419 posed as AI insiders to target US policy experts. Image credit: Shutterstock / Futurism

What Happened in the TA419 Spear Phishing Campaign

On October 1, 2026, the security company Proofpoint published research on a group it tracks as TA419. Proofpoint describes it as China-aligned and focused on espionage. You can read the full Proofpoint TA419 threat research for the technical details.

The key points are easy to follow:

Who was targeted: AI policy experts at US think tanks, universities and law firms.
Who was faked: Lynne Parker, former Principal Deputy Director of the White House Office of Science and Technology Policy, and Heidi Crebo-Rediker, an economist and foreign policy expert.
When: the Parker and Crebo-Rediker campaigns began on July 8, 2026.
The Anthropic angle: in February 2026, the group posed as a senior Anthropic employee to target an AI policy analyst at a US think tank.
The goal: access to the target's Microsoft cloud account.

Proofpoint says TA419 has targeted people at US and Japan based think tanks, defense contractors, universities and law firms since at least April 2025. The group's activity had not been reported publicly before.

How the Spear Phishing Trap Worked, Step by Step

What makes this campaign worth studying is its patience. The first email asked for nothing risky at all.

Step 1: A friendly, flattering invite

The opening emails invited targets to join a fake "AI Policy Advisory Committee" or to help with a supposed Senate Foreign Relations Committee report on AI export controls and supply chains. The February email to the think tank analyst used the subject line "Request for Feedback on Military Integration of Claude."

That subject was well chosen. It pointed to a real, public debate about the US military's use of Anthropic's Claude models.

Screenshot of a fake email from an account posing as Lynne Parker inviting the reader to join an AI Policy Advisory Committee — A TA419 lure posing as former White House official Lynne Parker. Note the free webmail address and the request for a reply before any link. Image credit: Proofpoint

Step 2: Wait for a reply

The attackers only sent a link after the target wrote back. Once someone replies, they feel they are in a real conversation, and the next message looks expected rather than suspicious.

Step 3: A shortened link to a fake OneDrive folder

The follow-up email carried a shortened URL that claimed to share more details. It passed through several attacker-controlled sites. The first one ran a Cloudflare Turnstile check behind a fake OneDrive loading screen, which helps filter out security scanners.

Step 4: A real Microsoft login, relayed by the attacker

This is the part that should worry every IT team. The final page used an adversary-in-the-middle (AitM) setup built on Frameless BitB, an open-source browser-in-the-browser kit. It showed a fake pop-up window that looked like a normal Chrome sign-in box.

Behind that window, the attacker's server passed everything through to the genuine Microsoft sign-in page in real time. According to Proofpoint, the victim's password, MFA code and conditional access checks would all succeed. Meanwhile, the attacker captured the session cookies that keep a user signed in.

Fake OneDrive page with a browser-in-the-browser Microsoft sign-in window used in an AitM phishing attack — The fake OneDrive page and pop-up sign-in window seen in July 2026. The real address bar shows an attacker domain, not Microsoft. Image credit: Proofpoint

Proofpoint also found a custom script that tracked each victim's progress through the login. It automatically ticked "Keep me signed in" to stretch the stolen session, and it submitted one-time codes as soon as they were valid.

Why Normal MFA Was Not Enough

Many teams think a one-time code from an app or SMS ends the phishing problem. This campaign shows why that is not true.

A code proves that a person typed it. It does not prove where they typed it. If an attacker sits in the middle and forwards the code to Microsoft within seconds, the login works, and the attacker walks away with a valid session.

That is why Proofpoint recommends phishing-resistant, origin-bound authentication such as passkeys. A passkey or FIDO2 security key is tied to the real website address. On a fake domain, it simply will not sign in.

The US Cybersecurity and Infrastructure Security Agency says the same thing in its CISA guide to phishing-resistant MFA. It names FIDO/WebAuthn and PKI-based methods as the strongest options.

Login method	Can an AitM proxy relay it?	Notes
Password only	Yes	Weakest option
SMS or email code	Yes	Code can be forwarded in real time
Authenticator app code	Yes	Same problem as SMS codes
Passkey or FIDO2 security key	Very hard	Bound to the real site address

What We Still Do Not Know

It is important not to overstate this report. As Nextgov/FCW's report on the TA419 campaign points out, Proofpoint did not say how many people were targeted. It also did not say whether any accounts were actually broken into or whether any information was stolen.

Some people did catch it. Lynne Parker told Nextgov/FCW that she learned of the fake emails on July 9, when two recipients contacted her through separate channels to ask if she had really sent them. "It is personally troubling to see the trust and relationships I've built over my career exploited to deceive others," she said.

That detail is the best lesson in the whole story. The people who checked through a second channel stopped the attack.

Why Spear Phishing Matters for Agencies in India and the USA

You might think a spy group chasing policy experts has nothing to do with a web or app development shop. I would push back on that for three reasons.

Agencies hold the keys. Our staff often have admin rights to client cloud accounts, code repositories and production databases. One stolen Microsoft 365 session can open far more than an inbox.
The lure fits our world too. Swap "AI Policy Advisory Committee" for "RFP for a new mobile app" or "feedback on our AI roadmap." Agencies answer outreach like that every day.
Cross-border work adds trust gaps. Teams in India working with US clients often meet contacts only over email and video. That makes it harder to spot a fake sender.

The broader context matters as well. Proofpoint links this activity to Chinese intelligence interest in US AI policy, export controls and model distillation. If your team works with AI models from different countries, our guide to Chinese AI models and bias risks covers how to talk through those trust questions with clients.

A Practical Spear Phishing Defense Checklist

None of these steps need a big budget. Most can start this week.

Lock down logins

Move admins to passkeys or security keys first. Start with anyone who has global admin, billing or production access in Microsoft 365, Google Workspace, AWS or GitHub.
Shorten session lifetimes for high-risk roles. Stolen cookies are less useful if sessions expire sooner.
Watch for odd sign-ins. Alert on new locations, new devices and logins right after a password reset.

Train people on the pattern, not just the link

Treat unsolicited expert outreach as a possible first step. Proofpoint gives this exact advice. Flattering invites and committee offers deserve a second look.
Verify through another channel. Call or message the person on a number or account you already have, not the one in the email.
Check the real address bar. A pop-up window can draw a fake one. Try dragging it outside the browser; a fake window cannot leave the page.
Be wary of free webmail. A senior official writing from a free email account should raise questions.

Test your own defenses

Run a safe, approved phishing simulation with your team every quarter. Pair it with regular security testing of your apps. We recently looked at how new tools are making this cheaper in our guide to AI penetration testing for agency teams.

A quick example

Say a project manager at a Bengaluru agency gets an email from someone claiming to lead AI strategy at a US retail client. It asks for "quick feedback on our 2027 AI plan." She replies, and a day later a OneDrive link arrives.

The pop-up asks her to sign in to Microsoft. Because her account uses a passkey, the sign-in fails on the fake domain. She messages the client contact on Slack, learns the email was fake and reports it. The whole attack ends there, with no stolen session.

If you want help building security into how your projects are planned and delivered, our software development consulting team works with businesses in India and the USA on secure architecture, access control and release planning.

Key Takeaways

Proofpoint says China-aligned group TA419 used spear phishing to target US AI policy experts in 2026.
The attackers posed as a senior Anthropic employee, former White House official Lynne Parker and economist Heidi Crebo-Rediker.
The trap was patient: a harmless invite, a reply, then a shortened link to a fake OneDrive page.
The fake login relayed real Microsoft sign-ins, so passwords and MFA codes alone could not stop it.
Passkeys, verification through a second channel and shorter admin sessions are the most useful defenses for agencies.

FAQ: Spear Phishing and the TA419 Campaign

What is TA419?

TA419 is the name Proofpoint uses for a China-aligned, espionage-focused hacking group. Proofpoint says it has run targeted credential phishing against think tanks, defense contractors, universities and law firms in the US and Japan since at least April 2025.

Who did the attackers pretend to be?

In February 2026 they posed as a senior Anthropic employee. From July 8, 2026 they posed as Lynne Parker, a former senior White House technology official, and Heidi Crebo-Rediker, an economist and former State Department chief economist.

Does multi-factor authentication stop this kind of spear phishing?

Not always. The fake page relayed the real Microsoft sign-in, so the password and one-time code worked while the attacker captured the session cookie. Phishing-resistant options like passkeys or FIDO2 security keys are much harder to relay.

Were any accounts actually hacked?

The public report does not say. Nextgov/FCW noted that Proofpoint did not share how many people were targeted, whether any accounts were compromised or whether any information was taken.

Why should an IT agency care about attacks on policy experts?

Agencies hold client admin access, source code and cloud keys, which makes their staff attractive targets. The same playbook of a friendly invite, a reply and then a fake file link works just as well against a project manager or developer.

About the Author

Nitin Kumar is Lead Project Coordinator at Debugged Pro. He plans software projects for clients in India and the USA and works with engineering teams on delivery, access control and secure releases.