Threat Analysis: TA419's Reply-Gated Phishing Against the AI Policy Sector

What happened

On October 1, 2026, researchers published the first public report on TA419. The report covers two sets of phishing aimed at people who work on U.S. AI policy. The first, in February 2026, posed as a senior employee of an AI company. The second, starting July 8, 2026, posed as a former White House official and then as a well-known economist.

This post goes through the published threat report in detail and uses it as its primary source. Where we add our own reading, we say so. We also list what the report leaves unanswered, because for a case like this the gaps matter as much as the findings.

Who TA419 is

Researchers describe TA419 as China-aligned and espionage-motivated. The research team states it has watched the group run regular, targeted credential phishing since at least April 2025, and that this activity had not been reported publicly before the October 1 post.

• Usual targets: individuals at U.S.- and Japan-based think tanks, defense contractors, universities and law firms.
• Usual subject areas: defense, national security, energy, international relations and foreign policy, mostly with a U.S. or Japan connection.
• AI policy: The report treats this as an extension of the same remit. The people who write and advise on AI regulation and export controls are now on the same target list as the people who cover defense and foreign policy.
• Likely purpose: better insight into U.S. AI policy and regulation, at a time of export controls, strategic competition and accusations of model distillation between the U.S. and China.

Timeline

The lures

The opening emails were deliberately dull. Each one invited the recipient to take part in something that sounds routine in policy circles. In July there were two versions. One invited the target to join an "AI Policy Advisory Committee". The other asked for a contribution to a report from a U.S. Senate committee on AI export controls and supply chains. Neither carried a link or an attachment.

The senders used free-mail addresses built around the impersonated person's name. The three addresses are in the indicator table. The names are real and the people are well known in this field. The accounts are not theirs.

The topics follow the news. The February lure referred to the public debate over U.S. military use of AI models. The July lures leaned on export controls. Our read is that TA419 picks whatever policy argument is live that month, and a future lure will probably do the same.

A target who answered got a second message with a shortened URL, presented as a way to share more information. That link is where the technical side of the attack begins.

The attack chain

Why the reply matters

Reply-gating moves the dangerous message out of the part of the process that security tooling watches most closely. A mail gateway sees a short, polite email from a free-mail address. A sandbox has nothing to detonate. URL reputation has nothing to score. The conversation then continues as a one-to-one exchange with a person who already believes they are talking to a colleague.

The attacker also learns something from the reply. The address is live, the person reads their mail, and they are willing to engage with the topic.

The Turnstile step

The first-stage domain does not host the phishing page. It shows a fake OneDrive loading screen and runs a Cloudflare Turnstile check, then forwards the visitor to the second domain. The original report describes the first domain as an initial filter. Our read is that Turnstile keeps most automated scanners away from the credential page, which means a scanner may record only the challenge page and a clean result should not be read as proof that a domain is harmless.

Inside the kit

The AitM page targets Microsoft 365 and Entra ID through the first-party OfficeHome application (client_id=4765445b-32c6-49b0-83e6-1d93765276ca). It is built on Frameless BitB, an open-source browser-in-the-browser kit.

The kit contains a browser-in-the-browser (BitB) overlay, an Evilginx phishlet for Microsoft 365, and server-side substitution rules that inject the kit into the proxied pages. The overlay is what produces the fake Chrome sign-in window the victim sees. Analysts note that TA419 extended the open-source kit with its own telemetry and automation module, which tracks and drives the target's progress through the Microsoft sign-in flow, including MFA.

The page the victim loads is the genuine Microsoft /common/oauth2/v2.0/authorize response, relayed in real time. The proxy injects two scripts into it.

The sequence from the victim's side is ordinary. They see what looks like a shared OneDrive folder, click a file, and get a browser-style sign-in popup, which is exactly what OneDrive does when access is needed. Nothing in that flow looks wrong.

Why MFA does not stop it

Behind the overlay, the proxy passes the sign-in to real Microsoft servers. The user's password is correct, the MFA code is correct, and conditional access sees a legitimate sign-in attempt. Microsoft issues a session, and the session cookies pass through the attacker's proxy on the way back. The attacker can then use them to open the account without any further login.

The custom script goes further than standard AitM tooling. Our read is that auto-submitting one-time codes removes the timing problem, because a code that expires in seconds is used before it lapses. Accepting "Keep me signed in" gives the stolen session a longer life. The live view of each sign-in lets the operator see which victims got through and which abandoned the page.

Infrastructure

Every domain TA419 uses for phishing sits behind Cloudflare's CDN, which hides the real hosting IP address. Analysts state the domains are typically registered through NameSilo and named after file-sharing and cloud services. Examples in the indicator list include cloudsyncpulse[.]com, onecloudfilesync[.]com and smartsyncbox[.]com.

The structure is the same each time: a first-stage domain that filters visitors and a second-stage domain that hosts the AitM page. The July pair was driftshare[.]co and globalfileshareplatform[.]com.

The first-seen dates in the indicator table show new infrastructure appearing in most months between December 2025 and July 2026. January and June are the exceptions. The report lists first-seen dates, so the registration dates themselves may be slightly earlier.

Organization look-alikes

TA419 sometimes registers domains that imitate a specific organization and sends phishing from them.

Sending infrastructure

On several occasions in 2026, the first-hop Received header in a phishing email exposed the server that sent it. Analysts believe these are actor-controlled virtual private servers. One example is 108.61.163[.]187.

All the servers observed shared one self-signed TLS certificate, found on a high ephemeral port. Its subject and issuer are C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI. Researchers assess the certificate is likely associated with a covert network used to anonymize TA419's operations. In other cases the group sent mail through residential proxy services.

Of everything in the report, the certificate is the most useful pivot for anyone with access to certificate-search data. Domains get replaced every few months. A certificate shared across sending servers is harder to rotate.

Indicators

ATT&CK mapping

This mapping is an independent assessment. Check it against your own taxonomy before reusing it.

Detection and hunting

The usual email indicators do not help much with the first message, so detection has to come from identity logs, network telemetry and the infrastructure above.

• Look back to December 2025. The earliest indicators date from then. Search DNS, proxy and firewall logs for every domain in the table.
• Mail headers. Search for 108.61.163[.]187 in first-hop Received headers. Also look for first contact from free-mail addresses whose display name matches a known public figure, particularly when the message asks for a reply about an advisory committee, a report or export controls.
• Certificate pivots. Search certificate datasets by the SHA256 fingerprint and by the O=Castro Inc subject to find related hosts.
• Entra ID sign-ins. Look for successful sign-ins to the OfficeHome application followed within the hour by non-interactive token use from a different network. The query below is a starting point. Field names and table availability depend on your tenant, and mobile users or VPN users will produce noise.
• Scanner results. Turnstile-gated pages can look blank or benign to automated scanners. Do not clear a domain on a clean scan alone.

// OfficeHome sign-in, then token use from a different ASN within 60 minutes
let window = 60m;
SigninLogs
| where TimeGenerated > ago(30d) and ResultType == 0
| where AppId == "4765445b-32c6-49b0-83e6-1d93765276ca"
| project UserPrincipalName, LoginTime = TimeGenerated,
LoginIP = IPAddress, LoginASN = AutonomousSystemNumber
| join kind=inner (
AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(30d) and ResultType == 0
| project UserPrincipalName, ReuseTime = TimeGenerated,
ReuseIP = IPAddress, ReuseASN = AutonomousSystemNumber,
ResourceDisplayName
) on UserPrincipalName
| where ReuseTime between (LoginTime .. (LoginTime + window))
| where ReuseASN != LoginASN

If you suspect an account was taken

• Revoke the user's refresh tokens and active sessions. Resetting the password alone does not end a stolen session.
• Check for new inbox rules, forwarding addresses and delegated access.
• Review OAuth consents and any MFA methods added recently.
• Review mailbox and OneDrive access logs for the period after the suspected sign-in.

Attribution and confidence

What we don't know

What to do about it

• Move at-risk people to origin-bound authentication. Passkeys and FIDO2 keys are tied to the real sign-in domain, so a proxy on a look-alike domain cannot relay them. SMS codes, authenticator codes and push approvals can all be relayed.
• Start with the people most likely to be approached. Policy analysts, researchers, fellows and small-firm lawyers often have lighter security support than a corporate user.
• Verify out of band. Anyone who receives an unexpected request tied to their field, even a polite one with no link, should confirm it through a different channel before replying.
• Tighten session controls where your licensing allows. Conditional access that requires compliant devices, and token protection where supported, make a stolen cookie harder to use.
• Filter new domains. Newly registered, file-sharing themed domains are a recurring pattern here. DNS filtering that flags them can catch the second hop even when the email looks clean.
• Prepare a response playbook. Session revocation, mailbox rule review and consent audits should be a documented routine before an incident, not worked out during one.

Published October 5, 2026. Based on threat intelligence reporting from October 1, 2026. Indicators are taken from that report and have not been independently verified.