That report, issued Thursday (Oct. 1) by cybersecurity firm Proofpoint, said that a hacking group known as “TA419” has since last year routinely attempted to steal passwords from think tanks, defense contractors, universities and law firms in Japan and the U.S.

“Proofpoint assesses that TA419 will likely continue targeting think tanks and policy experts working on technologies, and in geographies, of particular interest to the Chinese government,” the report said. “These campaigns will likely also continue spoofing the identities of real subject-matter experts.”

The company recommends that organizations “in the scope of TA419 activity should consider phishing-resistant, origin-bound authentication such as passkeys,” while also treating “unsolicited subject-matter outreach as a plausible pretext stage and seek to verify the legitimacy of such unexpected communications via another independent medium.”

In one recent campaign that began in July, TA419 impersonated Lynne Parker, former principal deputy director of the White House Office of Science and Technology Policy, and then economist/foreign policy expert Heidi Crebo-Rediker, in campaigns targeting AI policy experts at American think tanks, law firms and universities.

Proofpoint said the emails would pitch AI-themed collaborations or initiatives before sending them links to a “credential phishing page designed to gain access to the target’s cloud account.”

The company did not say who the hackers were targeting, other than that the group included “experts working on AI regulation, export controls and national AI strategy.”

However, a report by Reuters said the news outlet was able to identify one of them independently: Alex Engler, a former White House official who now heads the Penn Center on Media, Technology, and Democracy.

Engler told Reuters Wednesday he had gotten an email appearing to come from Parker inviting him “to join a new AI policy project.”

However, he said the email “felt slightly, nebulously off” and after consulting with others in the field, realized he had been contacted by an impostor.

The Federal Trade Commission (FTC) has said that scams in which criminals impersonate government officials or businesses are routinely one of the main types of frauds reported by consumers. In 2024, such scams cost Americans nearly $3 billion.

The PYMNTS Intelligence report “Financial Scams and Consumer Trust” found that eight out of every 10 of successful scams are impersonation scams in which fraudsters pose as trusted authorities, friendly strangers or personal contacts.