A China-aligned threat actor designated TA419 conducted a series of targeted credential-phishing campaigns against American AI policy experts beginning in February 2026 and intensifying through July, cybersecurity firm Proofpoint disclosed on October 1. In July 2026, TA419 conducted multiple credential phishing campaigns impersonating prominent economists and AI policymakers to target AI experts working for U.S. think tanks, universities, and legal sector organizations. Proofpoint has observed the group running targeted credential phishing campaigns against individuals at U.S.- and Japan-based think tanks, defense contractors, universities, and law firms since at least April 2025, activity that had not been previously reported publicly.
The operation was notable for the precision of its social engineering. Beginning on July 8, 2026, TA419 impersonated Lynne Edwards Parker, the former Principal Deputy Director of the White House Office of Science and Technology Policy, and then Heidi Crebo-Rediker, a prominent economist and foreign policy expert, in campaigns targeting AI policy experts at U.S. think tanks, universities, and law firms. The suspected operatives' emails invited their targets to join a fake AI policy advisory committee or contribute to a Senate Foreign Relations Committee report on AI export controls and supply chains. The technique was deliberately staged: the first messages contained no credential-stealing link; TA419 used those emails to obtain a response before sending a shortened URL that claimed to provide additional information. That link routed victims through infrastructure that used a customized version of an open-source "Browser-in-the-Browser" phishing tool and an adversary-in-the-middle technique to capture Microsoft 365 passwords, multifactor authentication codes, and session cookies. An earlier wave, in February, demonstrated the same pattern at a different angle: the group impersonated a senior Anthropic employee to target an AI policy analyst at a U.S. think tank, with the email carrying the subject line "Request for Feedback on Military Integration of Claude," a reference to the debate over the U.S. military's use of Anthropic's Claude models.
The campaign's footprint was deliberately narrow. Fewer than ten individuals were targeted, according to Proofpoint, which did not disclose whether any accounts were successfully compromised; the highly selective nature of the campaign suggests an intelligence-gathering effort focused on U.S. AI policymaking and regulatory planning rather than broad credential harvesting. Beyond individuals, Proofpoint's report lists domains impersonating the Japan-Taiwan Exchange Association, The Heritage Foundation, and the official website of Japanese Minister of Defense Shinjiro Koizumi. The real Lynne Parker confirmed the impersonation to reporters: colleagues had begun reaching out to her after receiving suspicious emails from people claiming to be her.
Skeptics note that the raw number of targets is small enough that the practical damage could be limited, and Proofpoint itself acknowledges it cannot say whether any account was breached. Proofpoint's threat analyst Mark Kelly nonetheless drew the broader implication plainly: TA419 and other Beijing-aligned crews will likely continue targeting AI and other policy experts working on technologies of interest to the Chinese government. As a defensive measure, Proofpoint recommends that organizations within the scope of TA419 activity consider phishing-resistant, origin-bound authentication such as passkeys.
The takeaway is blunt: if you write or advise on U.S. AI export controls, assume the invitation in your inbox from a respected colleague may be a Beijing intelligence operation.