Chinese hackers impersonated US policymakers in adversary-in-the-middle (AiTM) phishing campaigns aimed at stealing credentials from artificial intelligence (AI) experts working for US think tanks, universities, and legal organizations.
Researchers from Proofpoint discovered the campaign, which occurred in July, and attributed it to China-aligned threat actor TA419, according to a blog post published last week. The activity is believed to be part of a broader Chinese cyber espionage effort to gather intelligence on US AI policymaking and planning.
"Proofpoint has observed TA419 conducting regular targeted credential phishing campaigns against individuals working for US- and Japan-based think tanks, defense contractors, universities, and law firms since at least April 2025," Proofpoint cyber threat intelligence analyst Mark Kelly and the Proofpoint Threat Research Team wrote in the post.
TA419 impersonated multiple individuals in the campaign, including a former member of the White House Office of Science and Technology Policy leadership team, and engaged with victims through a series of emails. The July campaign followed an earlier operation in February in which the same threat actor impersonated an Anthropic employee to target an AI policy expert at a US think tank, according to Proofpoint.
"This activity likely supports wider Chinese intelligence objectives to better understand ongoing developments within the US AI policy and regulatory landscape and occurs amid intense strategic competition, accusations of model distillation, and export controls involving the US and China," the researchers wrote.