Cyber-Enabled Transnational Repression: The "Carp" Campaigns China-Linked Outsourced Phishing and Digital Impersonation Operations- 169

May 18, 2026

Joint research from Citizen Lab, the International Consortium of Investigative Journalists (ICIJ), and Proofpoint shows an emerging model of Chinese state-sponsored cyber operations. Recent forensic investigations have uncovered a nine-month, highly coordinated digital campaign utilizing more than 100 malicious domains to target journalists, diaspora activists, and strategic industry sectors.

Unlike traditional state-led advanced persistent threats (APTs), these operations—distinctly tracked as GLITTER CARP and SEQUIN CARP—are attributed to low-cost freelance hackers contracted by the Chinese state. This industrialized outsourcing strategy provides Beijing with affordable scalability and convenient plausible deniability while driving down the political costs of overseas harassment.

The report breaks down the operational profiles of both campaigns, their tactical variations, and the systemic "chilling effect" this evolving model of transnational repression imposes on global civil society and strategic economic sectors.

Recent research attributes two coordinated, long-running phishing and digital impersonation campaigns targeting journalists and diaspora activists to freelance hackers operating on behalf of the Chinese state. The campaigns, active over a nine-month period and leveraging more than 100 malicious domains, focused on credential theft as a precursor to follow-on intelligence or disruption operations aligned with Beijing’s interests.

 The investigation, led by Citizen Lab in partnership with the International Consortium of Investigative Journalists, began in April 2025 following a report by Uyghur-Canadian activist Mehmet Tohti. Tohti was targeted via a multi-stage social engineering attempt combining WhatsApp impersonation, malicious email links, and spoofed Google security alerts, designed to harvest account credentials. While the attempt failed, forensic analysis uncovered two distinct but related campaigns assessed as China-linked.

 The first campaign, designated GLITTER CARP, was broad, persistent, and operationally aggressive. It targeted journalists, activists, and civil society figures—including individuals with only tangential links to priority groups—and impersonated ICIJ members to enhance credibility. Researchers assess the campaign as resource-rich, unconcerned with exposure, and optimized for scale rather than stealth. Independent findings by Proofpoint further link this activity cluster to targeting within Taiwan’s semiconductor sector, suggesting tasking that extends beyond repression into strategic economic intelligence.

 The second campaign, SEQUIN CARP, was more narrowly focused, primarily targeting journalists reporting on China-sensitive topics, including ICIJ reporter Scilla Alecci. SEQUIN CARP relied heavily on tailored personas and sustained social engineering, but exhibited weaker tradecraft, limited adaptability, and poor contingency handling when initial intrusion attempts failed. Despite higher investment in human interaction, its technical execution was assessed as comparatively unsophisticated.

 Collectively, the campaigns illustrate a broader Chinese model of outsourcing transnational digital repression to low-cost independent contractors. This approach significantly reduces the financial and political cost of overseas targeting while providing Beijing with plausible deniability. Researchers warn that this “industrialized” contracting model lowers barriers to sustained harassment and surveillance of diaspora communities, journalists, and advocacy networks abroad.

 Beyond the immediate cyber risk, the operations have had tangible chilling effects. Tohti, already subject to long-term pressure from Chinese authorities, reported increased security measures, device replacements, and regular forensic checks. He also noted a secondary impact: activists and partners withdrawing from collaboration out of fear of exposure, eroding trust, communication safety, and organizational effectiveness.

 Overall, the findings reinforce concerns that cyber-enabled transnational repression is becoming normalized, scalable, and increasingly embedded in China’s external influence and intelligence posture, with journalists and diaspora civil society remaining high-priority targets.