Loading story…
Taiwanese authorities have charged two local executives for allegedly helping China-linked cyber operators run a social-engineering and espionage campaign against Taiwanese officials, academics, journalists, NGO workers, and civil society figures. Investigators said the men obtained Taiwanese LINE accounts and leased them to Xiamen Empress Information Technology Co. Ltd., a company authorities say is tied to China’s cyber forces, allowing operators to impersonate journalists associated with the International Consortium of Investigative Journalists and approach targets with phishing messages and other deceptive outreach.
The case aligns with earlier findings from ICIJ and Citizen Lab, which documented a broader Beijing-linked operation that used fake journalist personas, LinkedIn messages, paid article offers, phishing emails, and malware disguised as secure communications software to steal information from people of interest to the Chinese government. Reporting on the wider campaign said the infrastructure included more than 100 malicious domains and targeted dissidents, democracy activists, and Uyghur, Tibetan, Hong Kong, and Taiwanese communities, underscoring how commercial intermediaries allegedly supported state-linked cyber espionage.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Taiwanese authorities charged two executives linked to local firm Abigail for allegedly helping China-linked cyber operators by obtaining and leasing LINE accounts used to impersonate journalists and target officials, scholars, journalists, and NGO workers. Investigators said the accounts were provided to Xiamen Empress Information Technology, which authorities linked to China's cyber forces.
Taiwan's Ministry of Justice Investigation Bureau announced it had uncovered a case involving Xiamen Empress Information Technology allegedly impersonating international journalists to conduct social-engineering attacks against Taiwanese political and academic figures.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourceicij.org
Open sourcemjib.gov.tw
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities and researchers are highlighting **China-linked espionage** that increasingly leverages online recruitment and employment channels to access sensitive information. Reporting on recent federal cases describes foreign intelligence services posing as consulting firms, research groups, or recruiters to approach current and former U.S. government personnel—often starting via email or job platforms and escalating through staged interviews, fake websites, and payment offers—to solicit **classified or sensitive information**; multiple Justice Department actions in 2025 reportedly involved such virtual-first recruitment approaches. Separately, a former Google engineer, **Linwei Ding**, was found guilty of **economic espionage and trade secret theft** after prosecutors said he exfiltrated over 2,000 pages of confidential AI supercomputing documents (including TPU/GPU architecture details, orchestration software, SmartNIC networking designs, and internal system configurations) and uploaded them to a personal cloud account while maintaining undisclosed ties to China-based companies and engaging with a Shanghai-sponsored talent program. Broader context from CSIS’ long-running survey of Chinese espionage cases underscores that these incidents fit a sustained pattern since 2000 spanning both **human intelligence** and **cyber-enabled theft** targeting U.S. government and commercial technologies, while noting open-source case lists likely undercount the true scope.
Jun 29, 2026
Citizen Lab and the International Consortium of Investigative Journalists reported that two China-aligned threat clusters, **GLITTER CARP** and **SEQUIN CARP**, ran sustained phishing and impersonation campaigns against journalists, activists, and diaspora civil society members tied to Tibet, Taiwan, Hong Kong, and the Uyghur region. The activity began as early as April 2025 and used fake login pages, bogus security alerts, impersonated personas, tracking pixels, and infrastructure spread across more than 100 domains to steal credentials and monitor targets. Researchers said the campaigns also reached ICIJ personnel and other individuals connected to reporting on Chinese transnational repression. Citizen Lab said **GLITTER CARP** operated as a broad, persistent credential-phishing effort, while **SEQUIN CARP** more narrowly targeted journalists with persona-driven social engineering and OAuth consent phishing designed to gain lasting Gmail access through legitimate Google authorization flows and refresh tokens. The researchers assessed with high confidence that the operations aligned with Chinese government interests and with medium confidence that the actors may be freelance contractors linked to China’s Military-Civil Fusion ecosystem, a model that lowers costs and increases plausible deniability while extending digital transnational repression beyond China’s borders.
Jun 29, 2026
Reporting indicates **China-linked intelligence activity** is targeting current and former Western government officials through both human and technical collection. In the US case, a suspected Chinese influence/collection network using a purported consultancy (*Foresight and Strategy*) allegedly approached a former senior State Department official and offered payment to produce an assessment of US policy priorities in Venezuela, consistent with prior research describing a nexus of fake companies and websites used to recruit people with government and think-tank policy experience. In the UK, Chinese state-linked hackers are accused of maintaining years-long access to communications associated with senior Downing Street officials, with reporting alleging compromises affecting phones used by aides to former prime ministers **Boris Johnson, Liz Truss, and Rishi Sunak** dating back to 2021 and discovered in 2024. The activity has been linked by sources to **Salt Typhoon**, a China-aligned espionage group associated with telecom-provider intrusions that can enable collection of call metadata and potentially content (texts/calls), allowing intelligence value even without direct handset malware.
Jun 29, 2026