China-linked hackers posed as former US officials, Anthropic employee to target AI experts

Chinese-linked hackers impersonated former U.S. officials, including a former White House technology official and a State Department economist, as well as an employee of Anthropic, to target artificial intelligence policy experts. The attackers initiated contact by posing as these figures to invite researchers to join fictitious groups or contribute to purported reports on AI policy and export controls. Upon engagement, the impersonators directed recipients to malicious links intended to steal Microsoft login credentials. The activity was linked to a group tracked as TA419, which is described as China-aligned. The targeting extended beyond this initial phase; the attackers also impersonated an Anthropic employee in a separate campaign targeting an AI policy analyst. The hacking efforts focused on researchers at think tanks, universities, and law firms.

The operational method observed demonstrates an adaptation where adversaries exploit established professional trust networks—specifically those built around high-level policy work—as a primary vector for initial access, rather than relying solely on technical exploits. The focus on targeting AI policy experts demonstrates an expansion of traditional intelligence objectives into the emerging domain of technological governance and strategic policy shaping. This suggests that in the context of the global AI race, intellectual capital and professional relationships are being recognized as high-value intelligence assets by state actors. The impersonation tactic is a sophisticated application of social engineering, leveraging established hierarchies (former officials, corporate employees) to bypass standard security vetting. Furthermore, the linking of this activity to broader patterns involving former government officials and academic researchers highlights a systemic vulnerability where the very structures that foster knowledge exchange become targets for exploitation. This reflects a transition in espionage tactics where the manipulation of discourse and personal credibility becomes as critical as the compromise of digital credentials to gather strategic intelligence on future technological developments and geopolitical positions.