Over the past five weeks, Chinese human rights defenders and activists have received party invitations from email accounts displaying names they recognize. These emails, which were later identified as phishing attempts, impersonated familiar services such as Evite, Greetings Island, and Punchbowl, and used subject lines including “Birthday Bash—You’re on the Guest List,” “A Memorable Evening,” “Protected Invitation,” “Welcome to My Party,” and “Sent You an Invitation,” making the emails appear legitimate and personally relevant to their recipients.
However, when recipients clicked buttons of “View Invitation,” “RSVP,” “See Who’s Coming,” and “Open Your Invitation,” they were redirected to unrelated and suspicious websites that did not match the displayed hyperlink destination. Some recipients then tried to verify the authenticity of the invitation or simply remove themselves from the mailing list. However, links labeled “Privacy Policy,” “Remove Yourself,” or “Block This Host” also redirected them to malicious websites.
Technical evidence suggests that some emails may have been transmitted through compromised accounts rather than merely using forged sender addresses (a tactic known as “spoofing,” in which the attacker edits the email heading and sender to appear as if it is from a known party). This makes the campaign especially dangerous, as the recipients are more likely to trust a message that comes from a familiar name and a genuine email account.
While there is insufficient evidence to attribute the campaign to the Chinese government or to a specific threat actor, the observed pattern is consistent with an active phishing campaign targeting Chinese human rights defenders and activists. From the examples collected so far, it seems that one possible objective of these emails is credential theft. After clicking a malicious link, a recipient may be taken to a fake Google, Microsoft, or other login page designed to steal a password, authentication code, or active session. More advanced phishing systems may also be capable of bypassing conventional multifactor authentication by capturing session information.
HRIC strongly advises readers not to click any unsolicited invitation links, even when a message appears to come from someone you know. Instead, contact the apparent sender through a separate, trusted channel, and confirm whether the invitation is genuine.
If you have already clicked the link but did not enter any information, close the page immediately and do not revisit. If you entered a password, authentication code, or any other account information, change your passwords immediately, sign out of active sessions and review recent account activity for anything unusual. If available, enable phishing-resistant multifactor authentication, warn your contacts and ask your organization’s security team to examine the email.