TA419: the MFA prompt was real, and the session was still stolen.

What is confirmed

On 1 October 2026, Proofpoint published research on TA419, a group it assesses as China-aligned and motivated by espionage. Proofpoint says it has watched TA419 run targeted credential phishing since at least April 2025, and that the activity had not been publicly reported before. Proofpoint report.

The targets are individuals at think tanks, defence contractors, universities and law firms based in the US and Japan. The recurring themes are defence, national security, energy, international relations and foreign policy.

The newest campaigns, from July 2026, went after people working on US AI policy:

Who it pretended to be. First Lynne Parker, a former Principal Deputy Director of the White House Office of Science and Technology Policy. Then Heidi Crebo-Rediker, an economist and foreign policy expert. Both were impersonated through freemail accounts.
The lure. An invitation to join an AI policy advisory committee that does not exist, and a request to contribute to a Senate Foreign Relations Committee report on AI export controls and supply chains.
The order of events. The first email carried no link. A shortened link came only after the target replied.

Earlier, in February 2026, TA419 posed as a senior Anthropic employee and asked for feedback on military use of the company's AI model. Proofpoint also mentions UNK_SweetSpecter, a cluster it reported in 2024 for AI-themed phishing that delivered the SugarGh0st remote access trojan to people connected to a US AI organisation. Proofpoint, May 2024.

Several sender domains point at Japan. Proofpoint lists lookalikes for the Japan–Taiwan Exchange Association (tw-koryu[.]org), for the official website of Defence Minister Shinjirō Koizumi (shinjirou[.]info), and for the Heritage Foundation (heritiages[.]org, heritiage[.]org).

When	What	Source
April 2025	Earliest TA419 activity Proofpoint reports	Proofpoint
December 2025	Earliest first-seen date in the published indicators	Proofpoint
February 2026	Anthropic employee impersonated; Koizumi website lookalike first seen	Proofpoint
March 2026	Heritage Foundation lookalikes first seen	Proofpoint
May 2026	Japan–Taiwan Exchange Association lookalike first seen	Proofpoint
July 2026	Campaigns impersonating Parker, then Crebo-Rediker	Proofpoint
1 October 2026	Research published in English and Japanese	EN, JA

How the sign-in is stolen

The chain has five steps. Figure 1 sets out each one with the control that can stop it and the evidence it may leave.

Five stages in a row: pose as someone trusted, link after the reply, fake window, real sign-in relayed, session reused. Under each stage, what happens, the control that stops it, and the evidence it may leave. A note says the source does not describe what happened after stage 5.

Figure 1. The attack chain with control points. Stages from Proofpoint; controls and evidence are this article's analysis. Original graphic.

The link. After the reply, the target receives a shortened link. It leads to a first-stage domain that shows a fake OneDrive loading screen in front of a Cloudflare Turnstile check. Turnstile is a bot check. In practice it also keeps automated scanners and sandboxes from reaching the real page.

The fake window. The second-stage domain shows a OneDrive-style file listing. The lure documents in it are real files hosted in a OneDrive account the attacker controls. When the target tries to open one, a sign-in window appears, styled as a Chrome browser window with a Microsoft address in its address bar. That window is part of the web page. Proofpoint says the kit is built on Frameless BitB, an open-source browser-in-the-browser project, combined with an Evilginx phishlet for Microsoft 365.

The relay. Behind the drawn window, the kit passes the genuine Microsoft sign-in page through the attacker's server. It requests a sign-in to OfficeHome, a first-party Microsoft application (client ID 4765445b-32c6-49b0-83e6-1d93765276ca). Proofpoint describes three injected scripts:

/secondary/script.js draws the window and the file listing.
/primary/script.js handles clicks and touches, and raises the fake window.
/secondary/observe.js reports the victim's progress to the operator, gives a live view of the session, and accepts the "Stay signed in?" prompt automatically. It also submits one-time codes as soon as they are typed.

The result. The victim completes the password, MFA and Conditional Access steps against the real service, and the attacker's server keeps the session cookie that Microsoft issues at the end.

Why MFA did not stop it

Editorial assessment. The MFA challenge was genuine. The victim answered it for the attacker. One-time codes, push approvals, number matching, SMS and phone calls can all be relayed this way, because the person sees the real prompt and responds to it.

Passkeys, FIDO2 security keys, Windows Hello for Business and certificate-based authentication behave differently. The browser releases those credentials only to Microsoft's real domain. On the attacker's domain they cannot be used. The address in a drawn window does not change that, because the browser checks the domain of the page itself.

The drawn window also defeats a common piece of training. "Check the address bar" fails when the address bar is part of the page. Better habits: a password manager that refuses to fill in the password, and a window that cannot be dragged outside the browser.

Why Japanese organisations should read this closely

Proofpoint names Japan-based organisations as targets and lists lookalikes for a Japan–Taiwan body and a Japanese minister's website. Editorial assessment: those choices suggest approaches written for people who follow Japanese security and Japan–Taiwan policy, not only US policy circles. The report does not say who received mail from those domains.

Japanese think tanks have been warned before. In January 2025, the National Police Agency and NISC described MirrorFace, a different group, targeting think tanks, politicians and media with malware attachments and download links. NPA and NISC advisory (Japanese).

TA419 shows the other half of the problem. Its chain installs nothing on the device. An EDR agent sees a browser visiting a website. The account is the target, and the evidence sits in identity and mail logs. If your defences against MirrorFace were endpoint controls, they do not cover this.

What changes in the security review

Editorial assessment. Six questions for an organisation whose staff work on policy, defence or technology:

Who is exposed? Researchers, fellows, former officials and external advisers. They often use accounts that the identity team rolls out to last: visiting accounts, shared mailboxes, personal addresses used for outreach.
Is phishing-resistant authentication enforced, or only offered? If weaker methods remain registered, the relay page can steer the user to one of them. Enforce a phishing-resistant authentication strength in Conditional Access for the exposed groups.
Does browser access need a managed device? A relayed sign-in reaches Microsoft from the attacker's server, which has no device identity. A Conditional Access policy requiring a compliant device blocks it. Where personal devices are allowed, this control is missing.
How long is a stolen session worth? The kit accepts "Stay signed in?" automatically, which makes the browser cookie persistent. Without that choice, Microsoft says the cookie lasts 24 hours or until the browser closes. Microsoft, Stay signed in prompt. Turning the prompt off in Entra user settings, or setting browser sessions to never persistent in Conditional Access, shortens the window. So do sign-in frequency for high-risk users and risk-based policies that demand a fresh phishing-resistant sign-in. Microsoft's token theft guidance adds network-based limits on where a session can be used. Its token protection feature covers Windows desktop apps, not browser sessions like this one.
Is there a way to check an approach? A committee invitation or a report review request from a senior figure is normal work at a think tank. Staff need a quick way to verify through a contact they already have, and a place to report approaches that do not check out.
Do sandbox verdicts mean anything here? A Turnstile gate shows the scanner a challenge page. A clean detonation result is not evidence that the link is safe.

Which teams should act

Team	Practical next step
Email security	Block the published sender addresses and domains. Find staff who replied to them: a reply is what triggered the link. Add the names of senior external contacts your staff hear from to impersonation protection.
IT operations (identity)	Enforce phishing-resistant authentication and compliant devices for the exposed groups. Set sign-in frequency and risk policies. Write down how to revoke a user's sessions and who may do it out of hours.
SIEM / SOC	Run the hunts below. Make sure AiTM and stolen-cookie alerts from Defender and Entra ID Protection reach a person. Look at OfficeHome sign-ins from hosting providers.
EDR	Expect little: the chain installs no malware. Use web protection to block the domains, and check browser history on any device where the hunts find a hit.
Legal / privacy	If a session was used, the mailbox may hold correspondents' personal data and unpublished policy work. Decide in advance who assesses notification duties, and who tells an organisation that was impersonated.

Indicators of compromise

Indicators come from Proofpoint's report and are defanged here. Figure 2 shows how often they changed.

Indicator	Type	Role	First seen
`leparker@mail[.]com`	Email address	Sender, Parker impersonation	July 2026
`hcrediker@mail[.]com`	Email address	Sender, Crebo-Rediker impersonation	July 2026
`hcrediker@outlook[.]com`	Email address	Sender, Crebo-Rediker impersonation	July 2026
`driftshare[.]co`	Domain	Stage 1 redirect	July 2026
`globalfileshareplatform[.]com`	Domain	Stage 2 AitM page	July 2026
`quickfly[.]online`	Domain	Stage 1 redirect	May 2026
`smartsyncbox[.]com`	Domain	Stage 2 AitM page	May 2026
`cirrushare[.]co`	Domain	Stage 1 redirect	April 2026
`mypublicshare[.]com`	Domain	Stage 2 AitM page	March 2026
`goshshare[.]online`	Domain	Stage 1 redirect	March 2026
`synchvault[.]co`	Domain	Stage 1 redirect	March 2026
`cloudsyncpulse[.]com`	Domain	Stage 2 AitM page	March 2026
`onecloudfilesync[.]com`	Domain	Stage 2 AitM page	February 2026
`msfile[.]online`	Domain	Stage 1 redirect	February 2026
`winsync[.]cloud`	Domain	Stage 1 redirect	February 2026
`publicsharefile[.]cloud`	Domain	Stage 2 AitM page	February 2026
`fileswiftonline[.]cloud`	Domain	Stage 2 AitM page	December 2025
`sharehub[.]space`	Domain	Stage 1 redirect	December 2025
`tw-koryu[.]org`	Domain	Sender, Japan–Taiwan Exchange Association lookalike	May 2026
`heritiages[.]org`	Domain	Sender, Heritage Foundation lookalike	March 2026
`heritiage[.]org`	Domain	Sender, Heritage Foundation lookalike	March 2026
`shinjirou[.]info`	Domain	Sender, Koizumi website lookalike	February 2026
`b314a1499cd728ca3e54b7150661fd0c7d2279065fe3f570f0f66c395d744460`	TLS certificate SHA-256	Self-signed certificate on sending servers	February 2026

Indicators grouped by the month they were first seen, from December 2025 to July 2026. New domains appear in six of the eight months; January and June have none.

Figure 2. Published infrastructure by first-seen month. Original graphic.

Proofpoint gives more context that is useful for pivoting:

Sending servers. The first Received header of the emails exposed VPS servers. Proofpoint gives 108.61.163[.]187 as an example. The servers share the self-signed certificate above, served on a high port, with the subject C=US, ST=Kansas, L=Millsstad,O=Castro Inc, CN=CI. The actor also sent through residential proxies, which leave no stable address.
Domains. Registered through NameSilo and placed behind Cloudflare. Names follow a file-sharing and cloud-sync theme.
Lure subject, February 2026. "Request for Feedback on Military Integration of Claude".

How to use them. Most domains were first seen months ago, and new ones appeared in six of the eight months shown. Block them, and sweep back to December 2025 where your logs reach. Do not rely on them for future detection. The certificate is a better pivot for threat intelligence teams using internet scan data than for SOC searches, because your own network rarely connects to a sending server. The OfficeHome client ID is a legitimate Microsoft application, not an indicator: use it to narrow sign-in searches, never to block.

MITRE ATT&CK

This mapping is ours, not Proofpoint's.

Behaviour	Technique
Posing as real policy figures and organisations	T1656 Impersonation
Freemail sender accounts	T1585.002 Establish Accounts: Email Accounts
Lookalike and file-sharing-themed domains	T1583.001 Acquire Infrastructure: Domains
VPS sending servers	T1583.003 Acquire Infrastructure: Virtual Private Server
Link sent after the target replies	T1566.002 Phishing: Spearphishing Link
Relaying the real sign-in	T1557 Adversary-in-the-Middle
One-time codes passed through the relay	T1111 Multi-Factor Authentication Interception
Capturing the session cookie	T1539 Steal Web Session Cookie
Using the stolen session	T1550.004 Use Alternate Authentication Material: Web Session Cookie
Residential proxies	T1090 Proxy

Hunting: KQL and Splunk

All queries here are illustrative and were not run against live data. Table and column names were checked against Microsoft Learn on 2 October 2026. Replace the placeholders, check the time window against your retention, and treat a hit as a lead to investigate.

1. Indicator sweep across mail, clicks and devices. Microsoft Defender XDR advanced hunting. Needs Defender for Office 365 for EmailEvents and UrlClickEvents, and Defender for Endpoint for DeviceNetworkEvents. The query also finds outbound replies to the impersonation addresses. Those replies identify the people who were sent the link.

// Illustrative. Microsoft Defender XDR advanced hunting.
// Advanced hunting keeps 30 days. For older indicators, run the same logic
// where these tables are kept longer (for example Microsoft Sentinel,
// where Timestamp becomes TimeGenerated).
let Infra = dynamic(["sharehub.space", "fileswiftonline.cloud", "msfile.online",
    "winsync.cloud", "onecloudfilesync.com", "publicsharefile.cloud",
    "goshshare.online", "synchvault.co", "mypublicshare.com",
    "cloudsyncpulse.com", "cirrushare.co", "quickfly.online",
    "smartsyncbox.com", "driftshare.co", "globalfileshareplatform.com"]);
let SenderDomains = dynamic(["tw-koryu.org", "heritiages.org", "heritiage.org",
    "shinjirou.info"]);
let SenderAddresses = dynamic(["leparker@mail.com", "hcrediker@mail.com",
    "hcrediker@outlook.com"]);
let Lookback = 30d;
union
    (EmailEvents
    | where Timestamp > ago(Lookback)
    | where SenderFromAddress in~ (SenderAddresses)
        or SenderMailFromAddress in~ (SenderAddresses)
        or SenderFromDomain in~ (SenderDomains)
        or SenderMailFromDomain in~ (SenderDomains)
        or RecipientEmailAddress in~ (SenderAddresses)
        or SenderIPv4 == "108.61.163.187"
    | project Timestamp, Source = "Mail",
        Account = iff(EmailDirection == "Outbound", SenderFromAddress, RecipientEmailAddress),
        Indicator = iff(EmailDirection == "Outbound", RecipientEmailAddress, SenderFromAddress),
        Detail = strcat(EmailDirection, " | ", Subject)),
    (UrlClickEvents
    | where Timestamp > ago(Lookback)
    | where Url has_any (Infra) or UrlChain has_any (Infra)
    | project Timestamp, Source = "Click", Account = AccountUpn,
        Indicator = Url, Detail = strcat(ActionType, " | ", UrlChain)),
    (DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where RemoteUrl has_any (Infra)
    | project Timestamp, Source = "Device", Account = InitiatingProcessAccountUpn,
        Indicator = RemoteUrl, Detail = strcat(DeviceName, " | ", InitiatingProcessFileName))
| order by Timestamp desc
| take 500

The link in the mail is shortened, so the infrastructure domains rarely appear in the message itself. They show up in the Safe Links redirect chain (UrlChain) and in device network events.

2. A session that starts with an OfficeHome sign-in and then moves. Microsoft Sentinel with Entra ID sign-in logs. In a relay, the sign-in reaches Microsoft from the attacker's server. The stolen cookie may then be used from somewhere else again.

// Illustrative. Microsoft Sentinel: SigninLogs and AADNonInteractiveUserSignInLogs.
// Sessions that began with a successful OfficeHome sign-in and were then
// used from more than one network (autonomous system).
let OfficeHome = "4765445b-32c6-49b0-83e6-1d93765276ca";
let Lookback = 14d;
let Starts = SigninLogs
    | where TimeGenerated > ago(Lookback)
    | where AppId == OfficeHome and ResultType == "0" and isnotempty(SessionId)
    | summarize arg_min(TimeGenerated, IPAddress, AutonomousSystemNumber)
        by SessionId, UserPrincipalName
    | project SessionId, UserPrincipalName, StartTime = TimeGenerated,
        StartIP = IPAddress, StartASN = AutonomousSystemNumber;
union SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(Lookback)
| where ResultType == "0" and isnotempty(SessionId)
| project TimeGenerated, SessionId, IPAddress, AutonomousSystemNumber, AppDisplayName
| join kind=inner Starts on SessionId
| where TimeGenerated >= StartTime
| summarize Networks = dcount(AutonomousSystemNumber),
    ASNs = make_set(AutonomousSystemNumber, 10),
    IPs = make_set(IPAddress, 20),
    Apps = make_set(AppDisplayName, 10),
    LastSeen = max(TimeGenerated)
    by UserPrincipalName, SessionId, StartTime, StartIP, StartASN
| where Networks > 1
| order by StartTime desc
| take 200

Expect noise. A laptop that moves from the office to home Wi-Fi to a phone hotspot changes networks within one session. Look first at sessions whose start is on a hosting provider's network your users do not normally use.

3. OfficeHome sign-ins with a rare TLS fingerprint. Defender XDR advanced hunting, EntraIdSignInEvents. This table needs Entra ID P2 and replaces AADSignInEventsBeta on 19 October 2026.

// Illustrative and experimental. Microsoft Defender XDR, EntraIdSignInEvents.
// Successful OfficeHome browser sign-ins whose TLS client fingerprint
// (GatewayJA4) is used by very few accounts in the tenant.
let OfficeHome = "4765445b-32c6-49b0-83e6-1d93765276ca";
let SignIns = EntraIdSignInEvents
    | where Timestamp > ago(14d)
    | where ApplicationId == OfficeHome and ErrorCode == 0
    | where ClientAppUsed == "Browser" and LogonType has "interactiveUser"
    | where isnotempty(GatewayJA4);
let Rare = SignIns
    | summarize Accounts = dcount(AccountObjectId) by GatewayJA4
    | where Accounts <= 2;
SignIns
| join kind=inner Rare on GatewayJA4
| project Timestamp, AccountUpn, IPAddress, Country, GatewayJA4, Accounts,
    UserAgent, IsManaged, IsCompliant, SessionId
| order by Timestamp desc
| take 200

The idea behind this one is our hypothesis, not a published detection. A relay server opens its own TLS connection to Microsoft. Unless it is built to imitate a browser, its fingerprint should differ from your users' Chrome and Edge. A rare fingerprint is not proof of anything, so compare it with the IP owner and the device fields.

4. Splunk: proxy and DNS logs. Raw-term search, so it works without knowing your field names. Searches from 1 December 2025, the month of the earliest indicator.

index=YOUR_PROXY_INDEX OR index=YOUR_DNS_INDEX earliest="12/01/2025:00:00:00" latest=now
("sharehub.space" OR "fileswiftonline.cloud" OR "msfile.online"
 OR "winsync.cloud" OR "onecloudfilesync.com" OR "publicsharefile.cloud"
 OR "goshshare.online" OR "synchvault.co" OR "mypublicshare.com"
 OR "cloudsyncpulse.com" OR "cirrushare.co" OR "quickfly.online"
 OR "smartsyncbox.com" OR "driftshare.co" OR "globalfileshareplatform.com")
| table _time index sourcetype host _raw
| sort - _time
| head 500

5. Splunk: mail gateway logs. Matches the sender addresses, sender domains and the example sending IP. Because it searches the raw event, it also finds staff replies to those addresses.

index=YOUR_MAIL_INDEX earliest="12/01/2025:00:00:00" latest=now
("leparker@mail.com" OR "hcrediker@mail.com" OR "hcrediker@outlook.com"
 OR "tw-koryu.org" OR "heritiages.org" OR "heritiage.org"
 OR "shinjirou.info" OR "108.61.163.187")
| table _time sourcetype host _raw
| sort - _time
| head 500

Check the built-in detections as well. Microsoft documents Defender XDR alerts such as "Stolen session cookie was used" and "Possible AiTM phishing attempt", and Entra ID Protection detections such as "Attacker in the Middle" and "Anomalous Token". Microsoft token theft guidance; session cookie theft alert grading.

Blind spots. No result does not mean no exposure:

A target who used a personal device or home network appears in none of the device or proxy logs.
Advanced hunting keeps 30 days, and most of these indicators are older than that.
The actor rotates domains. The next campaign will not use these.
Freemail senders cannot be blocked by domain, and residential proxies leave no stable sending address.

What remains unknown

How many people were targeted, and whether any account was taken over. The report gives no numbers and no confirmed compromise.
What happened after a session was stolen. Mailbox access, file downloads and follow-on phishing from a victim's account are not described.
Who in Japan received the Japan-themed approaches. The lookalike domains are listed; their recipients are not.
How TA419 relates to other tracked groups. Proofpoint presents it as previously unreported. Whether other vendors track the same activity under another name is not stated.
Other platforms. The kit described targets Microsoft 365. Whether Google Workspace or academic identity providers were targeted is not covered.

Reporting note

Reviewed for public information up to 2 October 2026, 05:20 UTC / 14:20 JST. Facts about TA419 come from Proofpoint's report, published 1 October 2026 in English and Japanese. Indicators were checked against Proofpoint's table on 2 October. They are defanged in the text and written in live form inside the query blocks so that the queries run.

Coverage by CyberScoop and Business+IT was read as a lead only. The MirrorFace paragraph uses the NPA and NISC advisory of 8 January 2025.

This is independent editorial analysis of published research. SecOpsNomad has not observed this activity and has not run these queries in a live environment.