Intelligence agencies and security researchers have uncovered coordinated hacking operations by Chinese state-sponsored groups that zeroed in on AI firms and governmental bodies across Asia, according to reports released this week.
Proofpoint's threat research team disclosed on Thursday details of an operation from July in which a Chinese-linked actor deployed phishing campaigns impersonating well-known economists and a former official from the White House Office of Science and Technology Policy.
The attacks focused on artificial intelligence specialists employed at academic institutions, policy research organizations and legal firms. Beginning on July 8, the initial wave of messages falsely presented themselves as coming from Lynne Edwards Parker, a onetime White House official, before later shifting to impersonate Heidi Crebo-Rediker, a prominent foreign policy analyst.
The phishing messages dangled the prospect of joining a nonexistent "AI Policy Advisory Committee" or contributing to a fabricated congressional inquiry into AI export restrictions.
The group first sent benign conversation starter emails, which included calls to action themed around AI policy such as joining an 'AI Policy Advisory Committee,' to build rapport and solicit a response from the target
Proofpoint researchers
Upon receiving replies, the attackers deployed a series of redirected links designed to harvest login credentials and additional sensitive data. These malicious URLs ultimately led victims to a fake OneDrive login page where they were prompted to enter their authentication details.
Proofpoint's analysis revealed that this same threat group had previously conducted operations against employees at American and Japanese research institutions, weapons manufacturers and universities. The group customarily established fraudulent domains mimicking authentic entities including The Heritage Foundation, the Japan-Taiwan Exchange Association and Japan's Defense Ministry office.
Antino backdoor deployed across eight Asian nations
A day earlier, Cisco Talos released a security notice detailing a separate campaign in which Chinese state-affiliated hackers deployed a backdoor tool against governmental institutions spanning Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar and Syria.
Cisco's incident response team documented 16 organizations that faced compromise or targeting attempts across the region between September 2025 and July 2026. The malware, designated Antino, functioned as a remote access tool permitting the attackers to gather intelligence, move data between systems and sustain persistent presence on compromised networks. Intelligence collection appeared to be the primary objective of the operation.
Phishing messages paired with deceptive documents served as the primary infection vector, with attackers attempting to manipulate recipients into engaging with malicious links or file attachments.
Talos first identified [the group's] campaign while investigating a spear-phishing campaign directed at Taiwan's academic, think tank, and civil society policy community in March 2026. Further investigation showed that the activity extended beyond the initial Taiwan operation. Talos subsequently identified confirmed or probable affected government and security environments across multiple Asian countries, alongside additional regional targeting supported by lure content.
Cisco
The operation commenced in the Philippines and progressed through subsequent waves, with the most recent targeting Indian organizations in June. Across all eight nations, researchers identified approximately 350 compromised machines.
The attackers employed diverse social engineering tactics in their lures, incorporating news coverage regarding the Trump administration, counterfeit event invitations, official-looking legislative materials and comparable content.
Cisco Talos identified connections between this campaign and a parallel operation documented by Symantec researchers, in which Chinese state-backed actors similarly deployed the Antino backdoor.
