TA419 faked an Anthropic exec to phish: MFA codes didn't help

Proofpoint reported on October 1 that a China-aligned group it tracks as TA419 ran browser-in-the-browser phishing against U.S. AI policy experts. One email came from a fake senior Anthropic employee with the subject "Request for Feedback on Military Integration of Claude." The targets were think tanks and universities, not online shops. But the toolkit steals passwords, MFA codes and live session cookies in one pass, and it works against any Microsoft 365 tenant, yours included.

What actually happened

Per Proofpoint and CyberScoop:

• Who was faked: a senior Anthropic employee (February 2026), plus former White House OSTP official Lynne Parker and economist Heidi Crebo-Rediker (July 2026).
• Step one, rapport: a harmless first email. An invite to an "AI Policy Advisory Committee," or a request for comments on a report. No link, nothing for a filter to catch.
• Step two, the link: after the target replied, a shortened URL. It went through a Cloudflare Turnstile check, then a fake OneDrive loading screen.
• Step three, the fake window: a modified copy of the open-source tool Frameless BitB drew a fake browser pop-up inside the page. Behind it, an adversary-in-the-middle relay passed everything to the real Microsoft login, live.
• What it took: passwords, MFA codes and session cookies. Custom scripts tracked each victim through the login steps.

CyberScoop notes the reports do not say whether any accounts were compromised.

Why browser-in-the-browser phishing matters for your business

SMS and app codes do not stop a relay. The victim types a real code into a fake window, and the attacker forwards it to Microsoft within seconds. The session cookie that comes back is the prize. It skips MFA until it expires. We covered the same weakness in the Apollo breach.

Passkeys do stop it. A passkey is bound to the real domain. On a fake page, the browser does not offer it. Proofpoint's first recommendation is exactly this: phishing-resistant, origin-bound sign-in. In Microsoft Entra, turn on passkeys and require them for admins first, then everyone with access to money or customer data.

The first email is the attack, too. Nobody clicked anything until they had answered a friendly note. Train staff on that pattern: an unsolicited, flattering request from a "known" name, followed by a link. Check the person through a channel you already have, not the reply-to address.

Fake pop-ups have a tell. A real browser window can be dragged outside the page. A BitB window is drawn inside the page, so it usually cannot. It is a small habit, and it works.

Sources: Proofpoint, CyberScoop.