China-linked hackers posed as former US officials, Anthropic employee to target AI experts

Executive Summary

Chinese-linked hackers impersonated former U.S. officials, including Lynne Parker and Heidi Crebo-Rediker, along with an Anthropic employee, to target artificial intelligence policy experts. The attackers initiated contact by inviting these experts to fictitious advisory committees or reports concerning AI policy and export controls, aiming to establish initial engagement. Following responses, the impersonators directed recipients to fake OneDrive pages to attempt the theft of Microsoft login credentials. A separate instance involved impersonating an Anthropic employee to solicit feedback regarding the military integration of Claude. The activity was linked to a group tracked as TA419, described as China-aligned. While the scope of compromise and data exfiltration is unspecified, the targeting focused on individuals working in AI policy at think tanks, universities, and law firms with a nexus to U.S. and Japan interests.

Facts Only

* Chinese hackers impersonated former senior White House technology official Lynne Parker, a former State Department economist Heidi Crebo-Rediker, and a senior Anthropic employee.
* The campaigns targeted researchers at think tanks, universities, and law firms.
* Hackers used invitations to advise on AI policy and export controls to initiate conversations with recipients.
* Recipients were sent links leading to fake OneDrive pages to steal Microsoft login credentials after engaging with the initial messages.
* Impersonations included Parker, a former principal deputy director of the White House Office of Science and Technology Policy, and Crebo-Rediker, a former State Department chief economist.
* The attackers also impersonated an Anthropic employee in a separate instance concerning Claude model use.
* The activity was connected to the group tracked as TA419, described as China-aligned.
* The impersonations began on July 8, involving invitations to join a fictitious “AI Policy Advisory Committee” or contribute to a purported Senate Foreign Relations Committee report.
* Attackers registered web addresses impersonating figures like Japan’s defense minister Shinjiro Koizumi and the Japan–Taiwan Exchange Association.
* The attackers consistently showed interest in defense, national security, energy, international relations, and foreign policy targets, predominantly with a nexus to the U.S. and Japan.

Full Take

The operational pattern demonstrates an escalation where seemingly benign professional networking is weaponized as an intelligence gathering vector against experts in sensitive domains. The attackers exploit the inherent trust within professional ecosystems—the expectation of collaboration and shared discourse on policy and technology—to execute credential theft, suggesting that social engineering built on contextual relevance is a primary mechanism for high-value espionage. The fact that the targeting extends beyond direct policy work to encompass AI expertise signals a strategic focus on controlling the knowledge base driving future technological and geopolitical decisions. This move reflects a recognition that access to private professional discussions about AI development, military applications, and international relations constitutes a critical layer of intelligence, extending beyond publicly available documents. The narrative suggests an enduring pattern where adversaries seek to exploit established relational dynamics rather than purely technical vulnerabilities for accessing sensitive information. What does the reliance on impersonating specific high-profile figures—those with deep institutional memory—imply about the adversary's assessment of human networks as vulnerable infrastructure? What are the long-term consequences when trust itself becomes the primary target?

From the original · Nextgov Cybersecurity

Proofpoint identified phishing campaigns that borrowed prominent figures’ identities to approach U.S. policy researchers before attempting to steal access to their cloud accounts.

Read the full story at nextgov.com

Sentinel — Human

Confidence

The text reads like a well-sourced journalistic report that successfully weaves technical findings with broader intelligence context, exhibiting characteristics of professional human reporting.

Signals Detected

Moderate sentence length variance; usage of direct quotes and attribution suggests human editorial layering.

Maintains a clear narrative flow connecting specific findings to broader geopolitical context without excessive, sterile balancing.

Uses diverse sources (Proofpoint report, personal quotes, historical context) naturally, avoiding verbatim repetition common in pure AI generation.

Specific details regarding names and events are verifiable through the cited source; no obvious confabulation detected.

Human Indicators

Integration of specific, context-rich personal testimony (from Lynne Parker) alongside technical reporting suggests human narrative construction.

The transition between technical findings and high-level geopolitical implications flows with an analytical arc rather than purely statistical aggregation.