China-aligned hackers impersonate US officials in AI policy phishing campaign

A China-aligned hacking group has impersonated US AI experts and a former White House technology official in a campaign targeting people involved in artificial intelligence policy, cybersecurity company Proofpoint said Thursday.

A China-aligned hacking group has impersonated US AI experts and a former White House technology official in a campaign targeting people involved in artificial intelligence policy, cybersecurity company Proofpoint said Thursday.

The group, which Proofpoint tracks as TA419, targeted AI experts at US think tanks, universities and law firms with emails designed to steal passwords and potentially gain access to their email accounts.

Proofpoint said the campaign involved impersonating Lynne Parker, a former principal deputy director of the White House Office of Science and Technology Policy, as well as other AI and policy experts. The group had also previously impersonated an employee of AI company Anthropic, according to Proofpoint.

The emails typically proposed AI-related collaborations or initiatives before directing recipients to websites designed to steal their login credentials, Proofpoint said.

Proofpoint said the campaign appeared aimed at gathering information about US AI regulation, export controls and national AI strategy rather than stealing AI technology itself.

Proofpoint researcher Mark Kelly said the company was confident the group was aligned with the Chinese government based on its targeting patterns, internet infrastructure, technical indicators and information from industry partners.

“We are confident that [the hacking group] is a Chinese government-aligned threat actor based on targeting consistently in line with Chinese government interests, observed infrastructure and technical artifacts, and corroboration from industry partners,” Kelly said in an email to Reuters.

Proofpoint did not identify the people it believed were targeted, saying they included experts working on AI regulation, export controls and national AI strategy. The campaign involved fewer than 10 people at a small number of organizations, according to the company.

Reuters independently identified one target as Alex Engler, a former White House official who now heads the Penn Center on Media, Technology, and Democracy at the University of Pennsylvania. Engler told Reuters he received an email appearing to come from Parker inviting him to join a new AI policy project.

Engler said the message seemed suspicious and that he realized he was dealing with an impersonator after checking with other people in the field.

Parker told Reuters that Engler was one of two people who received suspicious messages purporting to come from her in early July.

“The United States and China are in a competition around AI,” Parker said. “Trying to get people in the AI policy space to reveal information about their AI policy plans — if that indeed was what the objective was — it’s not surprising.”

Proofpoint said it has observed TA419 targeting people at US and Japanese think tanks, defense contractors, universities and law firms since at least 2025.

The Chinese Embassy in Washington did not immediately respond to a request for comment. Beijing has previously denied carrying out cyberespionage operations.

The campaign comes amid intensifying competition between Washington and Beijing over artificial intelligence, including disputes over technology exports and AI development. It was also reported shortly after US President Donald Trump and Chinese President Xi Jinping held a summit in Washington at which the two sides agreed to establish an AI communication channel for reporting incidents.