Chinese hackers impersonate US officials to steal AI experts' emails

TA419: TA419 is a China-aligned, espionage-motivated threat actor tracked by Proofpoint for credential-phishing campaigns against organizations in the United States and Japan. In this incident, it allegedly posed as figures including former White House technology official Lynne Parker to target people involved in AI regulation, export controls, and national AI strategy. Proofpoint: Proofpoint is a cybersecurity company that researches threats and provides protection against email-based attacks. It is relevant because its investigation identified the campaign, attributed it to TA419 based on malware, infrastructure, and targeting patterns, and characterized the activity as potentially focused on intelligence about U.S. AI policymaking. Alex Engler: Alex Engler is a former White House official who leads the Penn Center on Media, Technology, and Democracy. He is relevant because Reuters identified him as a recipient of a suspicious invitation that appeared to come from Parker and proposed participation in an AI policy project. Lynne Parker: Lynne Parker is a former principal deputy director of the White House Office of Science and Technology Policy who has worked in U.S. science and technology policy. Attackers allegedly used her identity in emails proposing AI-related collaborations to make credential-stealing websites appear credible. Chinese hackers: The term refers in this report to a China-aligned cyberespionage operation that Proofpoint tracks as TA419, rather than to a publicly identified individual or organization. The group is relevant because it allegedly impersonated AI policy experts and former U.S. officials in phishing emails designed to steal credentials from researchers and policymakers. Targeting: The reported targets included people connected to AI regulation, export controls, and national AI strategy at think tanks, universities, defense contractors, and law firms. Impersonation: The campaign used trusted professional identities and invitations to apparent AI collaborations to direct recipients toward websites intended to steal passwords. Cyberespionage: Proofpoint characterized the campaign as an intelligence-collection effort focused on U.S. policymaking, not merely an attempt to steal technical intellectual property.