SEQUIN CARP

SEQUIN CARP is a China-aligned phishing cluster identified by Citizen Lab and linked to digital transnational repression and espionage activity aligned with Chinese government interests. Citizen Lab assessed with high confidence that the attacks were carried out at the request of the Chinese government, and with medium confidence that commercial contractors in China’s Military-Civil Fusion ecosystem may have conducted the campaign. The cluster has been active since at least June 2025. SEQUIN CARP primarily targeted journalists, including ICIJ journalist Scilla Alecci and other international journalists reporting on topics of interest to the Chinese government, especially reporting related to Chinese transnational repression and the ICIJ “China Targets” investigation. Broader reporting also places SEQUIN CARP in a parallel activity track alongside GLITTER CARP targeting Uyghur, Tibetan, Taiwanese, and Hong Kong critics, diaspora activists, and investigative journalists. The group employs highly targeted phishing and social engineering, including personas based on real individuals. Reported tradecraft includes credential phishing and, notably, OAuth consent phishing to obtain persistent access to victims’ email accounts without requiring passwords. SEQUIN CARP abused legitimate Google OAuth 2.0 authorization flows, requested the https://mail.google.com/ scope for full Gmail access, and used access_type=offline to obtain refresh tokens that could survive password changes. Citizen Lab also reported use of cloud-hosted phishing pages and the legitimate Chinese push-notification service sctapi.ftqq[.]com to beacon browser fingerprints and victim identifiers when phishing links were clicked. The cluster has also been described as using impersonation emails and credential-harvesting pages. SEQUIN CARP shares similarities with Volexity’s UTA0388 and Trend Micro’s TAOTH. It was identified as a distinct cluster operating in parallel with GLITTER CARP.