China-Linked Hackers Impersonate US AI Experts in Espionage Campaign

An email landed in Alex Engler’s inbox appearing to come from someone he knew by reputation: Lynne Parker, a former senior White House artificial intelligence official.

The message was not threatening or obviously suspicious. It invited Engler, himself a former White House official and an AI policy expert, “to join a new AI policy project.”

But something bothered him.

The email “felt slightly, nebulously off,” Engler told Reuters. After checking with others in the AI policy community, he discovered that Parker had not sent it.

According to cybersecurity firm Proofpoint, Engler was among fewer than 10 people targeted in a sophisticated phishing operation linked by the company to a previously undisclosed China-aligned hacking group known as TA419.

For the best of our weekly content！

You are now signed up for our newsletter

Check your email to complete sign up

Rather than targeting AI companies directly for their technology, the operation appears to have focused on something potentially just as valuable: the people helping shape America’s policies on artificial intelligence.

Building trust before stealing credentials

In a report released Oct. 1, Proofpoint said it has observed TA419 conducting targeted credential-phishing campaigns against people connected to U.S. and Japanese think tanks, universities, defense contractors and law firms since at least April 2025.

The latest campaign focused specifically on experts working on AI regulation, export controls and national AI strategy.

Beginning July 8, the hackers impersonated Parker, formerly principal deputy director of the White House Office of Science and Technology Policy, as well as economist and foreign policy expert Heidi Crebo-Rediker.

The opening messages were deliberately mundane.

Targets were invited to participate in what appeared to be legitimate professional activities, including joining an “AI Policy Advisory Committee” or contributing to a supposed Senate Foreign Relations Committee report concerning AI export controls and supply chains, according to Proofpoint.

The group had used a similar tactic earlier in February, when it impersonated a senior Anthropic employee and approached an AI policy analyst at a U.S. think tank. That email asked for feedback on the military use of Anthropic’s Claude AI models.

Only after a target responded did the attack advance. The hackers would send a shortened link supposedly containing additional material. The link passed through several redirects before opening what appeared to be a Microsoft OneDrive login screen.

By that point, the attackers were no longer merely pretending to be another person. They were attempting to insert themselves into the victim’s Microsoft account.

A convincing login screen that can get around MFA

Proofpoint said TA419 used an adversary-in-the-middle phishing system built partly around an open-source tool known as Frameless BitB, or Browser-in-the-Browser.

The technique can make the victim believe he or she is interacting with a legitimate Microsoft sign-in process.

Behind the scenes, however, the attacker acts as an intermediary. The victim’s Microsoft 365 credentials are relayed to genuine Microsoft infrastructure in real time. That allows a normal password, multifactor authentication code and other login checks to succeed while the attacker captures the authenticated session cookie.

That distinction is important because it changes the familiar advice that enabling multifactor authentication is enough to stop someone who obtains a password.

In this type of attack, the criminal is attempting to hijack an already authenticated session rather than simply logging in later with a stolen password.

Proofpoint said TA419 had modified the phishing toolkit with its own monitoring and automation capabilities. The system could track a victim’s progress through the Microsoft login process, automatically select “Keep me signed in” and submit one-time verification codes once they were accepted.

Proofpoint recommends that organizations potentially exposed to the campaign consider phishing-resistant authentication methods such as passkeys. It also urged individuals receiving unexpected professional outreach to verify the sender through a separate communication channel before following links or sharing information.

Why AI policymakers matter

The relatively small number of people targeted may be one of the most significant details of the campaign.

Proofpoint declined to identify the victims publicly, but told Reuters that fewer than 10 people at a handful of organizations were targeted. The company said the selection suggested “an intelligence interest in U.S. policymaking rather than technology theft alone.”

In other words, the apparent objective was not necessarily to obtain an AI model or steal computer code. Access to the inbox of a person involved in AI regulation could expose private discussions about future export restrictions, national AI strategy, military applications and the policy debates taking place before decisions become public.

Proofpoint attributed TA419 to a China-aligned espionage operation based on several factors, including technical infrastructure, tools used in the campaigns and the selection of targets, which the company said aligned with Chinese intelligence interests. Beijing has repeatedly denied conducting cyberespionage operations.

The researchers also found that TA419 had registered domains impersonating other prominent organizations and individuals, including the Japan-Taiwan Exchange Association, the Heritage Foundation and Japanese Defense Minister Shinjiro Koizumi.

Proofpoint said the group has shown continuing interest in national security, defense, energy, international relations and foreign policy, particularly involving the United States and Japan. The move into AI policy therefore appears to expand an existing intelligence focus rather than represent an entirely new mission.

Parker told Reuters that the alleged Chinese interest in American AI policymaking would fit the wider strategic competition between Washington and Beijing.

“The United States and China are in a competition around AI,” she said.