Proofpoint: a China-aligned group posed as a former White House official and an Anthropic employee to phish US AI policy experts

The security company Proofpoint published a report on 1 October on a China-aligned espionage group it tracks as TA419. Its key finding: “In July 2026, a China-aligned threat actor Proofpoint tracks as TA419 conducted multiple credential phishing campaigns impersonating prominent economists and artificial intelligence (AI) policymakers to target AI experts working for US think tanks, universities, and legal sector organizations.”

Beginning on 8 July, the group impersonated Lynne Edwards Parker, the former Principal Deputy Director of the White House Office of Science and Technology Policy, and then Heidi Crebo-Rediker, an economist and foreign policy expert. The emails invited targets to join an “AI Policy Advisory Committee” or to contribute to a Senate Committee on Foreign Relations report on AI export controls and supply chains. Links led to a fake OneDrive page built to capture Microsoft 365 logins, multi-factor codes and session cookies as they passed through.

In February 2026, Proofpoint says, the same group impersonated a senior Anthropic employee to target an AI policy analyst at a US think tank, with the subject line “Request for Feedback on Military Integration of Claude.” Proofpoint has tracked TA419 against US- and Japan-based organisations since at least April 2025.

Its assessment: “This activity likely supports wider Chinese intelligence objectives to better understand ongoing developments within the US AI policy and regulatory landscape.” As CyberScoop notes, the report did not identify victims or state whether any accounts were compromised. Reuters, CNN and CyberScoop covered it the same day.

• Confirmed TA419 ran credential-phishing campaigns in July 2026 impersonating economists and AI policymakers to target AI experts at US think tanks, universities and law firms. Proofpoint
• Confirmed In February 2026 the group impersonated a senior Anthropic employee, with the subject line “Request for Feedback on Military Integration of Claude.” Proofpoint
• Claimed Proofpoint assesses that the activity likely supports wider Chinese intelligence objectives on the US AI policy and regulatory landscape. Proofpoint
• Reported The report did not identify victims or state whether any accounts were compromised. CyberScoop