A China-linked hacking group has spent more than a year impersonating American AI experts to steal emails from US and Japanese researchers, cybersecurity firm Proofpoint said in a report published Thursday.

The group, which Proofpoint tracks as TA419, posed as well-known figures including Lynne Parker, a former deputy director of the White House Office of Science and Technology Policy, and economist Heidi Crebo-Rediker.

The emails invited targets at think tanks, universities, defence contractors and law firms to join fake AI policy projects, then steered them to password-stealing websites. Some attacks used fake login pages that could bypass standard security checks.

Proofpoint attributed the campaign to China based on the malware, internet infrastructure and targeting patterns. One victim identified by Reuters was Alex Engler, a former White House official now at the University of Pennsylvania’s Penn Center.

Beijing has long denied conducting cyber-espionage. Proofpoint said organisations should verify unexpected outreach through a separate channel and consider phishing-resistant logins like passkeys for people working on AI regulation, export controls and national AI strategy.