China-linked hackers impersonated former U.S. officials and a senior Anthropic employee in phishing campaigns aimed at artificial-intelligence policy researchers, using professional invitations to pursue access to targets’ cloud accounts, Defense One reported, citing findings from cybersecurity company Proofpoint released Thursday.

The campaigns targeted researchers at think tanks, universities and law firms. The messages presented opportunities to advise on AI policy, export controls and supply chains. After recipients engaged with the senders, the attackers followed up with links to a counterfeit OneDrive page designed to capture Microsoft login credentials.

Proofpoint attributed the activity to TA419, a group it describes as aligned with China and supportive of Beijing’s intelligence interests. The reported operation involved the identities of Lynne Parker, a former principal deputy director of the White House Office of Science and Technology Policy, and Heidi Crebo-Rediker, the State Department’s first chief economist.

Starting July 8, the impersonators invited AI experts to join a fictitious “AI Policy Advisory Committee” or contribute to a purported Senate Foreign Relations Committee report on AI export controls and supply chains. Parker previously served as the White House office’s assistant director for AI and as founding director of the National AI Initiative Office. Crebo-Rediker previously worked as the Senate committee’s chief of international finance and economics and is now a senior fellow at the Council on Foreign Relations.

Parker said she learned of the impersonation July 9 after two recipients contacted her through separate channels to ask whether she had sent the messages. She told them the emails were fraudulent and alerted other colleagues.

“The challenge is that, without knowing who the bad actors are targeting, it’s difficult to reach everyone who might be at risk,” Parker said, according to the report. She also said it was troubling to see relationships built during her career used to deceive others, adding that targeting people in the field could provide access to information and networks.

The same group used a similar approach in February, Proofpoint said, when it impersonated an unnamed senior Anthropic employee in an email to an AI policy analyst at a U.S. think tank. The subject line, “Request for Feedback on Military Integration of Claude,” referred to debate over the military use of Anthropic’s AI models.

Proofpoint said TA419 has consistently pursued targets connected to defense, national security, energy, international relations and foreign policy, particularly those with ties to the United States and Japan. The company said the targeting of AI policy experts extended that established focus.

Proofpoint also identified web addresses impersonating the Heritage Foundation, Japan’s defense minister Shinjiro Koizumi and the Japan-Taiwan Exchange Association. The company said that posing as those figures and organizations could help convince experts that a malicious email was worth their time.

The findings do not specify how many people received the messages, whether any accounts were successfully compromised or whether the attackers obtained information. Proofpoint said the group will likely continue targeting think tanks and policy experts working on technologies and in regions of interest to the Chinese government, while spoofing real subject-matter experts’ identities.

The campaigns show how researchers working on AI policy, export controls and military applications can become targets of credential-theft attempts. The reported messages combined invitations tied to current policy debates with follow-up links that sought Microsoft account credentials, extending the operation beyond a single impersonated individual or organization.