Loading threat actor…
GLITTER CARP is a China-aligned phishing and surveillance cluster active since at least April 2025. It is associated with digital transnational repression and espionage-aligned collection against Uyghur, Tibetan, Taiwanese, and Hong Kong diaspora communities, as well as investigative journalists and other individuals reporting on topics of interest to the Chinese government. Reporting has also linked the cluster to targeting of the Taiwanese semiconductor industry. The activity aligns with Chinese government intelligence priorities, and some assessments suggest the operations may have been conducted by commercial contractors working on behalf of Chinese state interests. GLITTER CARP is primarily known for highly targeted phishing, impersonation, and credential-access operations. Its tradecraft includes spoofed security alerts, impersonation of trusted individuals and organizations, fake login pages, tracking pixels embedded in emails to confirm message opens and collect limited device and location telemetry, and social engineering designed to obtain either account credentials or third-party access tokens. The cluster has reused infrastructure and impersonated personas across multiple campaigns and victims. Related reporting has linked overlapping activity to UNK_SparkyCarp, and malware delivery associated with the cluster has been connected to HealthKick and an early GOVERSHELL variant. Victimology includes civil society organizations and activists tied to Uyghur, Tibetan, Taiwanese, and Hong Kong causes, along with the International Consortium of Investigative Journalists and journalists covering Chinese transnational repression. GLITTER CARP has been described as broader in scope than the related cluster SEQUIN CARP, which focused more narrowly on journalists through OAuth-consent phishing. GLITTER CARP forms part of a wider pattern in which China-aligned cyber operations combine conventional intelligence collection with surveillance and suppression of overseas critics.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
121 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
China-affiliated phishing cluster targeting journalists, civil society, diaspora activists, and the Taiwanese semiconductor industry through impersonation-based phishing, credential harvesting, OAuth token theft, and AiTM phishing infrastructure.
Related phishing campaign focused on surveillance and repression of diaspora activists and journalists by stealing email credentials or third-party access tokens.
Credential-harvesting and impersonation-focused phishing campaign targeting Uyghur, Tibetan, Taiwanese, and Hong Kong diaspora activists, as well as journalists including ICIJ personnel. The group appears focused on initial access to email accounts and may operate as part of China’s contractor ecosystem supporting digital transnational repression.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.