Loading threat actor…
GLITTER CARP is a China-aligned phishing and surveillance cluster active since at least April 2025. It is associated with digital transnational repression and espionage-aligned collection against Uyghur, Tibetan, Taiwanese, and Hong Kong diaspora communities, as well as investigative journalists and other individuals reporting on topics of interest to the Chinese government. Reporting has also linked the cluster to targeting of the Taiwanese semiconductor industry. The activity aligns with Chinese government intelligence priorities, and some assessments suggest the operations may have been conducted by commercial contractors working on behalf of Chinese state interests. GLITTER CARP is primarily known for highly targeted phishing, impersonation, and credential-access operations. Its tradecraft includes spoofed security alerts, impersonation of trusted individuals and organizations, fake login pages, tracking pixels embedded in emails to confirm message opens and collect limited device and location telemetry, and social engineering designed to obtain either account credentials or third-party access tokens. The cluster has reused infrastructure and impersonated personas across multiple campaigns and victims. Related reporting has linked overlapping activity to UNK_SparkyCarp, and malware delivery associated with the cluster has been connected to HealthKick and an early GOVERSHELL variant. Victimology includes civil society organizations and activists tied to Uyghur, Tibetan, Taiwanese, and Hong Kong causes, along with the International Consortium of Investigative Journalists and journalists covering Chinese transnational repression. GLITTER CARP has been described as broader in scope than the related cluster SEQUIN CARP, which focused more narrowly on journalists through OAuth-consent phishing. GLITTER CARP forms part of a wider pattern in which China-aligned cyber operations combine conventional intelligence collection with surveillance and suppression of overseas critics.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
1 malware family Mallory has associated with this actor across public reporting.
121 indicators attributed to this actor. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.