Chinese Hackers Impersonate Anthropic Exec and White House Official to Target AI Policy Experts
10 Sources
[1]
Suspected Chinese spies spoofed an Anthropic exec, ex-White House official in AI phishing
A suspected Chinese espionage group impersonated AI policy figures, including a senior Anthropic employee and a former White House official, in phishing campaigns targeting AI policy experts at US universities, think tanks, and law firms, security researchers say. The bulk of these campaigns
[2]
China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
A new China-nexus cyber espionage group known as TA419 has been attributed to multiple credential phishing campaigns targeting artificial intelligence (AI) experts working for U.S. think tanks, universities, and legal sector organizations. The campaigns have impersonated prominent economists and
[3]
Chinese hackers impersonated ex-US official to steal emails from AI experts
WASHINGTON, Oct 1 (Reuters) - Chinese hackers have been impersonating US AI experts, including a former government official, to try to steal emails from experts in AI at think tanks, universities, and other organizations, the cybersecurity company Proofpoint said on Thursday. In a report,
[4]
Suspected Chinese hackers posed as US AI insiders, Proofpoint says
The group impersonated a former White House official and an Anthropic employee to steal AI policy experts' email logins A group of hackers believed to have been acting on behalf of China pretended to be well-known American AI experts to obtain the email accounts of people who specialize in AI
[5]
Chinese Hackers Impersonate Anthropic Employee to Extract AI Secrets
More information Adding us as a Preferred Source in Google by using this link indicates that you would like to see more of our content in Google News results. Cybercriminals who appear to be Chinese hackers pretended to be Anthropic researchers and former government officials in a scheme to obtain
[6]
Chinese Hackers Impersonated Ex-US Official to Steal Emails From AI Experts
By Raphael Satter and AJ Vicens WASHINGTON, Oct 1 (Reuters) - Chinese hackers have been impersonating US AI experts, including a former government official, to try to steal emails from experts in AI at think tanks, universities, and other organizations, the cybersecurity company Proofpoint said
[7]
Chinese hackers: Chinese hackers impersonated ex-US official to steal emails from AI experts
In a report, Proofpoint said that it had watched the hackers - which it dubs "TA419" - regularly try to steal passwords from people working for US or Japanese think tanks, defense contractors, universities, and law firms since as far back as 2025. Chinese hackers have been impersonating US AI
[8]
China linked hackers pose as former US officials to steal emails from researchers, Proofpoint says
Chinese hackers have been impersonating US AI experts, including a former government official, to steal emails from AI experts at think tanks, universities, and other organizations, the cybersecurity company Proofpoint said on Thursday. In a report, Proofpoint said that it had watched the hackers,
[9]
Chinese Hackers Impersonate US AI Experts in Phishing Campaign | PYMNTS.com
That report, issued Thursday (Oct. 1) by cybersecurity firm Proofpoint, said that a hacking group known as "TA419" has since last year routinely attempted to steal passwords from think tanks, defense contractors, universities and law firms in Japan and the U.S. "Proofpoint assesses that TA419 will
[10]
Chinese hackers impersonated ex-US official to steal emails from AI experts
WASHINGTON, Oct 1 (Reuters) - Chinese hackers have been impersonating US AI experts, including a former government official, to try to steal emails from experts in AI at think tanks, universities, and other organizations, the cybersecurity company Proofpoint said on Thursday. In a report,
Share
Copy Link
A China-aligned cyber espionage group dubbed TA419 impersonated a senior Anthropic employee and former White House official Lynne Edwards Parker in sophisticated phishing campaigns targeting fewer than 10 US AI policy experts. The cybersecurity firm Proofpoint discovered the attacks focused on experts working on AI regulation, export controls, and national AI strategy at think tanks, universities, and law firms.
Chinese Hackers Launch Sophisticated Phishing Campaign Against US AI Policy Experts
A China-aligned cyber espionage group known as TA419 has executed sophisticated credential phishing campaigns targeting AI policy experts at US think tanks, universities, and law firms, according to cybersecurity firm Proofpoint
1
2
. The attacks, which intensified in July 2026, involved impersonating prominent figures including a senior Anthropic employee and Lynne Edwards Parker, the former principal deputy director of the White House Office of Science and Technology Policy1
3
.The Chinese hackers have been conducting these espionage activities since at least April 2025, consistently targeting individuals working on AI regulation, export controls, and national AI strategy
2
4
. Proofpoint attributed the hacking efforts to China based on the types of malware used, the internet infrastructure deployed, and targets that align with Chinese intelligence collection priorities3
.
Source: Jerusalem Post
Impersonation Tactics and Fake Advisory Committees
The credential phishing campaigns employed carefully crafted deception strategies. In February 2026, TA419 spoofed a senior Anthropic employee to phish an AI policy analyst at a US think tank, using the subject line "Request for Feedback on Military Integration of Claude"
1
5
. This approach exploited genuine concerns about military applications of Anthropic's AI model to establish credibility.Starting July 8, 2026, the Chinese hackers impersonated Lynne Edwards Parker and economist Heidi Crebo-Rediker in phishing emails sent to AI policy experts
1
. These messages invited targets to join a fabricated AI Policy Advisory Committee or contribute to a fictitious Senate Committee on Foreign Relations report on AI export controls and supply chains4
5
. Alex Engler, a former White House official now heading the Penn Center on Media, Technology, and Democracy, received one such email but recognized it "felt slightly, nebulously off" and verified it was fraudulent3
.
Source: PYMNTS
Multi-Stage Attack Infrastructure Using Browser-in-the-Browser Technique
When targets responded to the initial phishing emails, TA419 followed up with shortened URLs promising additional details. These links initiated a multi-stage redirection chain leading victims through driftshare[.]co as the first-stage domain and globalfileshareplatform[.]com as the second-stage domain
1
. The infrastructure conducted a Cloudflare Turnstile check behind a fake OneDrive loading screen before redirecting to an adversary-in-the-middle credential phishing page2
.The attack employed Frameless BitB, an advanced version of the Browser-in-the-Browser technique that spoofs trusted login pages without using HTML iframe elements
2
. TA419 extended this open-source tool with custom telemetry and automation modules that tracked victims' Microsoft sign-in flow and captured credentials using the adversary-in-the-middle proxy while relaying information to real Microsoft 365 infrastructure in the background2
. This seamless approach meant victims experienced successful sign-in events without realizing their session cookies had been stealthily captured2
.Strategic Intelligence Targeting Amid US-China AI Competition
Proofpoint assessed that the targeting of fewer than 10 individuals across a handful of organizations suggested "an intelligence interest in US policymaking rather than technology theft alone"
3
4
. The campaigns occurred amid intense geopolitical competition between the US and China over AI development, with Parker noting, "The United States and China are in a competition around AI"3
5
.
Source: The Register
The espionage activities align with broader Chinese intelligence objectives to understand ongoing developments within the US AI policy and regulatory landscape
2
. This comes as the US implements export controls and as accusations of model distillation emerge—OpenAI recently accused China's Moonshot AI of stealing American models' reasoning and data in attacks beginning July 1, 20261
.Related Stories
Broader Targeting Patterns and Infrastructure
TA419 has consistently demonstrated interest in defense, national security, energy, international relations, and foreign policy targets, predominantly with connections to the US and Japan
2
. The group typically uses Cloudflare's content delivery network to hide backend hosting IP addresses and themes its credential phishing domains around file sharing sites and cloud services, such as msfile[.]online and onecloudfilesync[.]com1
.The Chinese hackers also impersonate specific organizations, including the Japan-Taiwan Exchange Association, The Heritage Foundation, and Japanese Minister of Defense Shinjirō Koizumi's official website
1
. Proofpoint identified dozens of phishing and spoofed-sender domains used by the group throughout 20261
.Recommendations for Protection Against Persistent Threats
Proofpoint expects TA419 will likely continue targeting think tanks and AI policy experts working on technologies of particular interest to the Chinese government, while continuing to spoof identities of real subject-matter experts
4
5
. Organizations within the scope of TA419 activity should implement phishing-resistant, origin-bound authentication methods such as passkeys1
2
. Individual targets should treat unsolicited subject-matter outreach with caution and verify authenticity before proceeding2
. Parker expressed sadness that "relationships I've built over my career were being exploited by bad actors to deceive others"5
.References
Summarized by
Navi
[1]
Related Stories
OpenAI Thwarts China-Linked Phishing Attempt on Employees
09 Oct 2024•Technology
Anthropic accuses Alibaba of massive campaign to steal Claude AI capabilities with fake accounts
24 Jun 2026•Technology
Congress Calls Anthropic CEO to Testify on Chinese AI-Powered Cyberattack Campaign
26 Nov 2025•Policy and Regulation
Recent Highlights
Recent Highlights
Today's Top Stories
Don’t drown in AI news. We cut through the noise - filtering, ranking and summarizing the most important AI news, breakthroughs and research daily. Follow topics that matter to you and stay ahead.
