Sequin Carp: China-linked phishing uses fake whistleblowers to get journalists to approve malicious apps
China-linked Sequin Carp posed as whistleblowers to get journalists to approve a malicious app on a real Google sign-in, giving lasting Gmail access without a password. Never approve unexpected access requests. Review Google account permissions and remove unfamiliar apps.
Never approve a Google or Microsoft permission request that arrived through an unsolicited message, even if the sign-in page is genuine. Check myaccount.google.com/permissions now and remove apps you don't recognise, particularly any with full Gmail access.
What’s happening
Citizen Lab and the International Consortium of Investigative Journalists (ICIJ) disclosed on 27 April 2026 a China-linked campaign they call Sequin Carp. Attackers used invented personas, including a supposed whistleblower who fled to Japan, to email ICIJ's Scilla Alecci and other targets. The links opened a genuine Google sign-in and permission screen. Approving it gave the attacker an app with broad Gmail access (read, send and delete) that keeps working after a password change and bypasses two-factor codes. Citizen Lab tracked at least three attempts between June 2025 and March 2026, and attributed the work to actors affiliated with the Chinese government with high confidence. ICIJ said its reporters did not click, so no confirmed compromise was reported, and no overall victim count has been published. Because this is a technique, not a software flaw, there is nothing to patch. In July 2026 Taiwan's Ministry of Justice Investigation Bureau acted against two executives accused of leasing messaging accounts used to impersonate journalists in related activity. In September 2026 the FBI warned that similar consent phishing targets prominent people and their families.
- What
- Scam
- Affects
- Google and Microsoft account sign-in permissions (OAuth), used against journalists, activists and other prominent people
- Fixed in
- Nothing to patch
- Since
- 27 Apr 2026
- Closed
- 2 Sept 2026
Timeline
- Update
The FBI's Internet Crime Complaint Center warned that OAuth consent phishing has targeted prominent people, relatives and contacts since late 2025, using impersonated journalists, academics and event organisers. It did not name Sequin Carp.
- Update
Taiwan's Ministry of Justice Investigation Bureau announced action against two executives of a Taiwanese firm, Abigail, accused of leasing LINE messaging accounts used to impersonate journalists to a company allegedly linked to China's cyber army. The Taipei City Investigation Office issued deferred prosecution orders. ICIJ's article does not name Sequin Carp.
- Made public
ICIJ reported that more than 100 domains targeted at least a dozen people, including ICIJ reporters, Taiwanese journalists and officials, and diaspora activists. It said its reporters did not click the links. The Chinese Embassy in Washington denied the allegations.
- Made publicNothing to patch
Citizen Lab (report "Tall Tales") and ICIJ made the campaign public, naming two China-aligned clusters, SEQUIN CARP and GLITTER CARP. Citizen Lab attributed them to actors affiliated with the Chinese government, with high confidence, and said the requested Gmail permissions would survive a password change. No overall victim count was published.
- Made public
A persona calling itself "Bin Bai", a supposed court assistant who fled to Japan, emailed ICIJ's Scilla Alecci with a link that began a genuine Google sign-in and permission request. Citizen Lab later tracked at least three attempts against her and ICIJ partner accounts between June 2025 and March 2026, including a second persona ("Caleb Brooks") in September 2025.
Sources
- Tall Tales: How Chinese Actors Use Impersonation and Stolen Narratives to Perpetuate Digital Transnational RepressionCitizen Lab · 27 Apr 2026
- Phony whistleblowers, fake journalists and cyber spies: China targets reportersICIJ · 27 Apr 2026
- Taiwanese authorities charge executives who helped China's cyber spies target ICIJ networkICIJ · 7 July 2026
- Attackers are going after prominent individuals through OAuth phishing, FBI warnsHelp Net Security · 2 Sept 2026