China-Aligned Hackers Target AI Policy Experts with Impersonation Phishing, Proofpoint Reports

A China-aligned threat actor tracked by Proofpoint as TA419 has conducted targeted credential-phishing campaigns since at least April 2025, with a notable July 2026 operation impersonating prominent AI policymakers to access accounts of U.S. experts at think tanks, universities, and law firms. The group sent initial benign emails posing as former White House Office of Science and Technology Policy Principal Deputy Director Lynne Edwards Parker and economist Heidi Crebo-Rediker, inviting recipients to join fictitious "AI Policy Advisory Committee" efforts or contribute to reports on AI export controls and supply chains. Replies led to adversary-in-the-middle phishing pages stealing Microsoft 365 credentials and session cookies.

Proofpoint attributes TA419 to Chinese intelligence priorities based on malware, infrastructure, and targeting patterns focused on AI regulation, national strategy, and related policy areas. The campaign affected fewer than 10 individuals across several organizations. One confirmed target, Alex Engler of the Penn Center on Media, Technology, and Democracy and a former White House official, received a suspicious email from a purported Parker and verified it as fraudulent after consulting colleagues. Parker confirmed at least two such impersonation attempts in early July.

An earlier February 2026 lure impersonated a senior Anthropic employee seeking feedback on military integration of Claude models. The activity underscores espionage interest in U.S. AI policy amid U.S.-China strategic competition, building on TA419's prior focus on defense, national security, and foreign policy targets in the U.S. and Japan. No confirmed compromises have been reported. Multiple outlets including Reuters independently verified details with affected individuals.