TA419’s phishing kit is an MFA relay attack: it does not try to break multi-factor authentication. It sits next to it, and lets the system work exactly as designed.
Proofpoint attributes a phishing campaign, run in two waves since February 2026 and most recently active from 8 July 2026, to this China-aligned group. The target list was small: fewer than ten individuals, spread across a handful of US and Japanese think tanks, universities, law firms and defence-adjacent organisations, all with a connection to AI policy work. Proofpoint has tracked TA419 activity against similar organisations since at least April 2025.
A Reply, Then Silence
The first email asked for nothing. No link, no attachment, just an invitation: join an AI policy advisory committee, or contribute to a report on AI export controls for a Senate committee. One version, sent in February, asked an AI policy analyst for feedback on the military’s use of Anthropic’s Claude models. The messages impersonated real people, including Lynne Edwards Parker, former principal deputy director at the White House Office of Science and Technology Policy, and economist Heidi Crebo-Rediker.
Only after the recipient replied did a shortened link arrive. That link ran through a redirect chain and a Cloudflare Turnstile check, then landed on a page built to look like OneDrive.
What an MFA Relay Attack Actually Means
The page ran on Frameless BitB, an open-source browser-in-the-browser toolkit published in January 2024. TA419 added its own telemetry. The fake window tracked the victim’s progress through a genuine Microsoft sign-in step by step, operating as an adversary-in-the-middle proxy against real Microsoft infrastructure in the background. The victim typed a real password into a real Microsoft login. They were prompted for MFA, and they completed it, a one-time code or a push approval. The automation watched for that moment and submitted the code once it validated. It also accepted the “keep me signed in” prompt on the victim’s behalf.
What left the building was the session cookie Microsoft issued after a fully successful login, MFA included, rather than any password. That cookie grants account access without asking for authentication again until someone revokes it, and a password reset on its own does nothing to invalidate it.
The Governance Blind Spot
Most organisations treat MFA as a line item. It gets enabled, it gets audited once, and the box stays ticked. Nobody revisits it because nothing visible ever changes. TA419’s tooling exploits that gap directly. The control itself worked. The password was real, the code was real, the login succeeded. What failed was the assumption underneath the control, that a successful authentication event means the session that follows it can also be trusted.
A PMO runs into the same failure mode with process controls generally. A stage gate gets approved once and treated as permanently satisfied. A risk register gets populated at kickoff and left untouched once the project is under way. The control exists on paper, the audit trail shows it was followed, and everyone moves on, right up until the thing the control was meant to catch happens downstream of it, unnoticed, because nobody was still watching after the gate closed.
What a PMO Can Actually Check
Three questions apply well beyond this specific attack. Does anyone monitor what happens after a control passes, not just whether it passed. Is there a way to revoke the access or standing that a one-time approval granted, separate from redoing the approval itself. And does the person who owns that control know the difference between a control that is present and a control that is still working.
Proofpoint’s own recommendation is to move to phishing-resistant, origin-bound authentication such as passkeys, which cannot be relayed the way a one-time code or push notification can. The governance fix runs wider than this one attack. Pick the control in your own portfolio that was checked once and never checked again, and name what would have to go wrong for nobody to notice until it already had.
