Spearphishing Campaign Targets Exiled Uyghur Leaders, Delivers Malware

Senior members of the World Uyghur Congress (WUC), an organization representing exiled Uyghurs, were targeted in a sophisticated spearphishing campaign in March 2025 that aimed to install Windows-based surveillance malware. The attackers impersonated trusted contacts and distributed malicious versions of a Uyghur-language word processing tool originally developed by a community member, leveraging the trust of the targeted individuals. Although the malware itself was not technically advanced, the campaign was highly tailored, demonstrating a deep understanding of the Uyghur community and utilizing social engineering techniques. Technical evidence indicates the campaign was prepared as early as May 2024 and aligned with patterns of digital transnational repression previously attributed to actors likely linked to the Chinese government. The spyware enabled remote surveillance and could download additional malicious plugins, posing ongoing risks to the Uyghur diaspora. The campaign highlights the continued use of digital tools to surveil and intimidate marginalized and exiled communities.