Chinese hackers have been impersonating US AI experts, including a former government official, to steal emails from AI experts at think tanks, universities, and other organizations, the cybersecurity company Proofpoint said on Thursday.
In a report, Proofpoint said that it had watched the hackers, which it dubs "TA419," regularly try to steal passwords from people working for US or Japanese think tanks, defense contractors, universities, and law firms since as far back as 2025.
Proofpoint attributed the hacking efforts to the Chinese group based on the types of malware the group used, the internet infrastructure used to carry out the attacks, and the targets it observed the group focusing on, which align with Chinese intelligence collection priorities.
Proofpoint said the hackers' recent campaign involved writing emails purporting to come from experts in AI or statecraft, including Lynne Parker, who previously worked as the principal deputy director of the White House's Office of Science and Technology Policy. Proofpoint said the emails would typically propose AI-themed collaborations or initiatives before steering targets toward password-stealing websites.
The Chinese Embassy in Washington did not immediately respond to requests for comment. Beijing has long denied carrying out cyberespionage operations.
Chinese cyber group targets US AI experts
Proofpoint declined to name the hackers' targets, saying only that the latter included "experts working on AI regulation, export controls and national AI strategy."
Reuters independently identified one of them: Alex Engler, a former White House official who now heads the Penn Center on Media, Technology, and Democracy.
Engler told Reuters on Wednesday that he received an email that appeared to come from Parker inviting him "to join a new AI policy project." But he said the email "felt slightly, nebulously off" and, after checking with others in the field, realized he was dealing with an impostor.
Engler said he could not speculate about why someone would try to hack him, but Proofpoint said that its view of the targeting, which involved fewer than 10 individuals working for a handful of organizations, suggested "an intelligence interest in US policymaking rather than technology theft alone."
Parker told Reuters that Engler was one of two people that she knew of who had received suspicious messages purporting to come from her in early July. She added that the allegation of Chinese involvement made sense.
"The United States and China are in a competition around AI," Parker said. "Trying to get people in the AI policy space to reveal information about their AI policy plans, if that indeed was what the objective was, it's not surprising."