Fake AI Advisory Invites Steal M365 Logins

Researchers say a China-aligned group (TA419) impersonated well-known AI policy figures and an Anthropic executive to lure US AI policy experts into replying to emails about a fake advisory committee or Senate report. Once a target engaged, the attackers sent shortened links that led through a fake OneDrive/Cloudflare check to a credential-phishing page designed to steal Microsoft 365 cloud login details (including session data).

Key findings

• Proofpoint attributed the activity to a China-aligned group it tracks as TA419.
• Targets were AI policy experts in US universities, think tanks, and law firms.
• Lures included invitations to a fake AI policy advisory committee and requests to contribute to a Senate report on AI export controls and supply chains.
• If a target replied, attackers sent a shortened link that ultimately led to an attacker-controlled domain and an attacker-in-the-middle credential phishing page.
• The chain used a Cloudflare Turnstile check and a fake OneDrive loading screen before redirecting to the phishing page.
• Known domains used in the July 2026 campaigns included driftshare[.]co (first stage) and globalfileshareplatform[.]com (second stage).
• Another lure impersonated a senior Anthropic employee with the subject line “Request for Feedback on Military Integration of Claude.”

Who’s being targeted

• Commonly targeted roles: University faculty and research staff, Think tank/policy research staff, Legal staff handling export controls / AI policy, Executive assistants supporting policy leaders, IT/helpdesk and identity/access management teams.
• Affected industries: Higher education (universities), Think tanks / policy research, Legal services (law firms).
• Attack channels: email, website.
• Impersonated: AI policy figures (e.g., former White House OSTP leadership), Senior Anthropic employee.

Awareness takeaways

• Treat unsolicited “committee invitations” and “policy report contributions” as high-risk, and verify the sender via a known, independent channel before replying or clicking anything.
• Be suspicious of shortened links and file-sharing themed domains; access collaboration documents only through known official portals/bookmarks.
• Watch for realistic-looking cloud login pages that appear after a “OneDrive loading screen” or web-check step, these can be designed to steal passwords and session cookies.
• Prioritize phishing-resistant authentication (for example, passkeys) for staff likely to be targeted for cloud-account takeover.

Red flags to watch for

• Unsolicited invitation to a high-profile committee/report with urgency or prestige framing
• A shortened URL that resolves to non-official, lookalike file-sharing/cloud domains
• Login prompt appears behind a “phony OneDrive loading screen” after a web check
• Unexpected policy request claiming to be from a senior person at a high-profile AI company
• Email-driven request that pushes the recipient to access “details” via an external link
• Any Microsoft 365 login prompt reached from a non-Microsoft domain