A China-linked hacking group has been impersonating US artificial intelligence experts, including a former White House official, in a phishing campaign targeting people involved in AI policy, regulation and national strategy.
Cybersecurity researchers identified the group as TA419 and said it has been targeting professionals at think tanks, universities, law firms and defense-related organizations in the United States and Japan. The activity has reportedly been observed since at least 2025.
The latest campaign involved attackers posing as prominent figures in AI and government policy. One of the identities used was Lynne Parker, a former principal deputy director of the White House Office of Science and Technology Policy.
The fraudulent emails were designed to look like legitimate professional invitations. Recipients were approached about joining an AI policy advisory group, contributing to research or participating in discussions involving AI regulation and export controls.
After establishing contact, the attackers directed recipients toward websites designed to steal their login credentials. Researchers said the campaign used convincing Microsoft login pages and other techniques intended to make the phishing attempts appear legitimate.
The operation appears to have focused on a relatively small number of highly targeted individuals. Researchers said fewer than 10 people working for several organizations were identified within the campaign, suggesting that the attackers were seeking specific information rather than conducting a broad mass-phishing operation.
One person independently identified as a target was Alex Engler, a former White House official who now leads the Penn Center on Media, Technology, and Democracy. Engler received an email appearing to come from Parker inviting him to participate in a new AI policy project.
Engler became suspicious of the message and contacted other people in the field before determining that the sender was an impostor. Parker later said that she became aware of the impersonation after recipients contacted her to verify whether she had sent the messages.
The attackers also reportedly impersonated Heidi Crebo-Rediker, an economist and foreign policy expert, in messages involving a purported Senate Foreign Relations Committee report on AI export controls and supply chains.
The campaign followed an earlier operation in February in which the same group allegedly impersonated a senior employee of AI company Anthropic. That effort similarly targeted an AI policy specialist and used a seemingly legitimate professional request as the starting point for an attempted credential theft.
Researchers believe the targeting could provide intelligence on US policymaking surrounding artificial intelligence, including regulation, export controls and national AI strategy. They said the activity fits the group’s broader interest in defense, national security, energy and foreign-policy targets.
Proofpoint attributed the activity to a China-aligned group based on factors including the malware and internet infrastructure involved, as well as the nature of the targets. The assessment is a cybersecurity firm’s attribution rather than an independently established finding that the Chinese government ordered the specific attacks. Beijing has repeatedly denied allegations of state-backed cyberespionage.
The campaign highlights how cyberattacks increasingly exploit professional trust rather than relying only on obvious malicious messages. By using the names and identities of recognized experts, attackers can make unsolicited invitations appear more credible and encourage targets to engage before introducing the credential-stealing component.
Security researchers have advised organizations and individuals working on sensitive AI issues to independently verify unexpected invitations, particularly when a message requests a login or directs recipients to an unfamiliar authentication page. Phishing-resistant authentication methods such as passkeys can also provide additional protection against credential theft.
The attacks come as artificial intelligence becomes increasingly connected to national security, economic policy and international competition, making the people involved in shaping AI policy potential targets for intelligence-gathering operations.
