Researchers traced campaigns in July impersonating named AI policy figures to a suspected Chinese espionage group.

 

What happened

A suspected Chinese espionage group impersonated real, named individuals working in AI policy to send credential phishing to experts at US universities, think tanks, and law firms, The Register reported on October 1, 2026. Researchers who identified the campaigns attributed them to a group they track as TA419 and said most of the activity occurred in July. From July 8 the group sent messages spoofing Lynne Edwards Parker, former principal deputy director of the White House Office of Science and Technology Policy, and then Heidi Crebo-Rediker, an economist and foreign policy expert. Recipients were invited to join a fake AI policy advisory committee or contribute to a Senate report on AI export controls. The credential theft targets Microsoft 365, which is the same platform most healthcare organizations run their staff email on.

 

Going deeper

Replying is what triggered the attack. The first message carried no link at all, and anyone who responded received a shortened web address said to contain further details. That address led to a page controlled by the attackers, which displayed what appeared to be a OneDrive file loading screen with a Cloudflare verification check running behind it, the kind of automated test a site uses to confirm a visitor is human. The victim was then passed to a page sitting between them and Microsoft's real login service, relaying everything typed in both directions while keeping a copy of the credentials and the session cookie, which is the token a browser holds after signing in successfully. The July campaigns used driftshare[.]co as the first address and globalfileshareplatform[.]com as the second.

 

What was said

Organizations within the scope of this activity "should consider phishing-resistant, origin-bound authentication such as passkeys," the researchers wrote in findings reported by The Register. They recorded an earlier instance in February, when the group spoofed a senior employee of the AI company Anthropic to phish a policy analyst at a US think tank, using the subject line "Request for Feedback on Military Integration of Claude."

 

In the know

The login page the victim sees is a drawing rather than a window. The kit builds what looks like a separate browser pop-up entirely inside the attacker's own page, using ordinary web code to render a title bar, window controls, a padlock symbol, and an address bar displaying Microsoft's genuine web address, according to The Register's account of the technique known as browser-in-the-browser. None of it is real browser machinery, so the address shown is simply text the attacker chose. The underlying code is publicly available on a code-sharing site, paired with a tool that intercepts usernames, passwords, and session cookies for Microsoft 365. The group routes its sites through a content delivery network, which hides the address of the server actually hosting them, and favours domain names themed around file sharing and cloud storage.

 

The big picture

Checking the address bar is the single most common instruction in phishing awareness training, and this technique was built to defeat it. NIST states the design objective for phishing-resistant authentication plainly, writing that verifier impersonation resistance exists so that security does not depend on the user detecting a phishing attack, because methods such as one-time codes cannot control where their output is entered. A passkey or security key checks the actual web address the browser is connected to rather than the one displayed, so it refuses to authenticate against a drawn imitation however convincing it looks. The case for moving past visual checks is already visible in the numbers, since Verizon found the human element present in 62% of breaches and recorded median click rates in voice and text-based phishing simulations running 40% higher than in email, in its 2026 report. Training that asks staff to spot a forgery is being measured against attacks designed so there is nothing to spot.

 

FAQs

How can a user tell a fake browser window from a real one?

A real pop-up is a separate operating system window and can be dragged outside the boundary of the page that opened it. A drawn imitation cannot leave that boundary, and clicking its address bar produces none of the behaviour a real one would.

 

Why does replying to the first email matter?

The initial message contains nothing for filtering to assess and nothing for the recipient to click. A reply confirms the address is live and the person is engaged, which is when the attacker sends the link.

 

What does origin-bound authentication mean?

The credential is cryptographically tied to the specific web address it was registered against. Presented with a different address, even one that looks identical on screen, it will not authenticate, which removes the user's judgment from the decision.

 

Does a password manager help against this?

Yes, in the same way. A password manager fills credentials based on the actual domain the browser has loaded rather than the text displayed in a window, so it will not offer credentials to an imitation.

 

Why impersonate named individuals rather than organizations?

A message from a recognizable person with a verifiable public profile carries more weight than one from a generic department, and recipients working in a specialized field often know of the person being impersonated even without having met them.