Adversary Intelligence — 2026-04-30

China-Linked Hackers Conducted Phishing Campaigns Targeting Journalists and Activists

A joint Citizen Lab, ICIJ, and CommonWealth Magazine investigation documented Chinese state-linked actors conducting phishing campaigns and impersonation operations against journalists, activists, and Taiwanese civil society targets. Operators impersonated a Taiwanese magazine editor-in-chief to sustain year-long conversations with targets, and IP infrastructure tied to the campaign overlaps with prior intrusions against semiconductor firms. ICIJ confirmed its own reporters were targeted following the organization's China Targets investigation. Citizen Lab assessed the actors harvest authentic content from prior compromises to build convincing impersonation personas, while offering free devices to lure targets into compromising their communications.

Analysis
The MSS is assessed as tasking these operations reactively against specific investigative outputs, corroborated across Citizen Lab, ICIJ, and CommonWealth Magazine. ICIJ was targeted following its China Targets probe; CommonWealth Magazine's editor-in-chief was impersonated over months-long cycles to penetrate Taiwan's civil society networks. IP infrastructure overlap with prior semiconductor-sector intrusions indicates shared Chinese attack infrastructure spanning Taiwan-focused HUMINT and industrial theft. The pattern may instead reflect state-adjacent contractors operating opportunistically, with the Taiwan impersonation a topology-mapping exercise rather than active recruitment. At least one additional disclosure is likely within 90 days. Taipei announcing formal press credential restrictions within 60 days is unlikely.

6 sources