Proofpoint Says Chinese Hackers Impersonated U.S. AI Experts in Policy Targeting

Chinese hackers reportedly impersonated U.S. AI experts to target policy organizations and professionals with credential-stealing

Chinese hackers are reportedly impersonating U.S. artificial intelligence experts in an effort to obtain sensitive policy information, according to information shared by Coin Bureau citing cybersecurity firm Proofpoint and Reuters.

Proofpoint said the group, tracked as TA419, has targeted think tanks, defense contractors, universities and law firms in the United States and Japan since 2025. The campaign reportedly uses the growing prominence of AI policy discussions to establish credibility with potential targets before attempting to steal their credentials.

Hackers Posed as AI and Statecraft Experts

According to Proofpoint, TA419 has approached targets while presenting its members as specialists in artificial intelligence and statecraft. The attackers reportedly pitch potential collaborations or research projects as a way to establish contact.

After engaging with targets, the hackers redirect them to websites designed to steal login credentials, according to the cybersecurity firm.

The approach relies on social engineering rather than simply markets attempting to breach systems through technical vulnerabilities. By impersonating recognizable experts and presenting seemingly relevant professional opportunities, the group can attempt to persuade recipients to interact with malicious links.

Proofpoint’s tracking of TA419 indicates that the campaign has extended across multiple types of organizations, including institutions involved in research, defense, higher education and legal services.

Former White House Official Among Reported Targets

One reported target was Alex Engler, a former White House official, according to Reuters as cited in the Coin Bureau post.

Engler reportedly received an email from an individual impersonating former U.S. technology official Lynne Parker. The message invited Engler to participate in an AI policy project, according to the report.

The impersonation provided the attackers with a way to make the outreach appear connected to legitimate policy and technology work. Such an approach can be particularly relevant when targeting individuals whose professional networks involve government policy, emerging technology or national security issues.

The reported targeting of Engler forms part of Proofpoint’s broader assessment of TA419’s activity since 2025.

Proofpoint Points to Policy Intelligence Interest

Proofpoint said the organizations and individuals targeted by TA419 indicate an interest in U.S. policymaking, rather than an exclusive focus on obtaining technology or corporate information.

The cybersecurity firm’s assessment places the campaign within a wider intelligence-gathering context, based on the targets selected and the themes used in the outreach.

The reported activity also shows how AI policy has become a useful theme for social-engineering campaigns. By presenting fraudulent collaboration opportunities around artificial intelligence and statecraft, attackers can attempt to gain access to people with connections to policy discussions and institutions.

Proofpoint’s findings do not establish that every recipient of the reported outreach provided information or credentials to the attackers. The campaign instead describes the methods used by TA419 to approach selected targets.

The group’s reported activity has continued since 2025, with U.S. and Japanese think tanks, defense contractors, universities and law firms among the organizations identified by Proofpoint.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.