In May 2025, Kuochun Hung, the chief operating officer of the Taiwanese media outlet Watchout, received an email from someone purporting to be Yi-Shan Chen, a well-regarded local reporter.

“Chen” claimed to be working for the International Consortium of Investigative Journalists and was requesting an interview with Hung on a range of topics: then pending impeachment proceedings against Taiwan’s president, the island’s divided government, and Watchout’s planned events with members of civil society groups.

Hung, whose media outlet monitors information manipulation, found the email unusual.

“The topic and questions in the invitation email [were] too entry-level for a senior journalist,” Hung told ICIJ. What’s more, Chen’s name was spelled in English, instead of the original Chinese, and the email address didn’t include ICIJ’s official domain.

Hung decided to find out more and started interacting with “Chen” on LINE, a popular messaging app in Taiwan.

The person, who used Chen’s name and photo in their handle, told Hung that an American journalist from ICIJ would meet him in Taipei for the interview and sent a link to what looked like an ICIJ webpage with the reporter’s photo. Hung noticed it wasn’t ICIJ’s real website. The fake Chen also sent Hung another link she said would direct him to a list of questions, adding: “For journalists, information security is truly very important,” a warning most journalists would find superfluous.

Hung didn’t click.

“I played stupid,” he said. “And then she gave up.”

Kuochun Hung, the chief operating officer of the Taiwanese media outlet Watchout. Image: Supplied / Kuochun Hung

Hung, who knows malicious links can be used to steal personal information, suspects that his interlocutor was a Chinese spy impersonating the real Yi-Shan Chen, a financial journalist and editor-in-chief of CommonWealth magazine — a trusted news source in Taiwan. As a member of ICIJ’s network, Chen has partnered with the Washington, D.C.-based news organization on many investigations, but is not an employee.

“They are spies with cyber capabilities,” Hung said. “Their goal is political.”

The real Chen told ICIJ in an interview that she shared Hung’s concerns. “Ironically, they are using the credibility of the investigative reporters to [collect] intelligence,” she said. Chen reported the impersonation attempt to Taiwanese authorities.

Now, an investigation by ICIJ, with the help of cybersecurity analysts at Toronto University’s Citizen Lab, has found that the incident was part of a sophisticated offensive strategy against ICIJ and its network following the 2025 publication of China Targets. The ICIJ-led exposé, in collaboration with 42 media outlets, revealed Beijing’s tactics to threaten, coerce and intimidate regime critics overseas.

Citizen Lab, which specializes in investigating digital threats, analyzed suspicious emails sent to this ICIJ reporter and other messages sent by ICIJ impersonators to targets in Asia, Europe and the United States. Detailing the findings in a report released today, one year after China Targets was published, the analysts said the attacks against the ICIJ network are part of “a wide-ranging campaign” aimed at stealing private information from entities of interest to the Chinese government. Those include Uyghur, Tibetan, Taiwanese, and Hong Kong diaspora activists, as well as journalists from ICIJ and elsewhere who report on activities related to these groups.

A fake website designed to look like an ICIJ landing page. The URL shows it is not an ICIJ webpage.

Rebekah Brown, who led the Citizen Lab investigation, said it indicated that so-called threat actors linked to the Chinese government had used surreptitious means to learn who ICIJ was talking to.

“We suspect that there was some sort of directive [saying] that it’s very important to know, especially after the China Targets report, who’s talking to you, what are you working on now? How can they intervene? How can they stop this narrative from growing?” Brown said. “That results in these targeted digital intrusions, both on [ICIJ] and on a lot of the communities who might possibly be telling you and other journalists things that the government doesn’t want.”

While the probe couldn’t identify which government agency may have given the orders, “we are highly confident that this is China,” said Brown, who in the past worked as a network warfare analyst for the U.S. government.

A Taiwanese national security official told CommonWealth magazine that the attacks are similar to others identified as part of a Chinese state-sponsored espionage operation.

In response to questions from ICIJ, a spokesperson for the Chinese Embassy in Washington, D.C., said that “China has always opposed and cracked down on any form of cyber attacks” and that transnational repression is “a completely fabricated narrative maliciously concocted by certain countries and organizations in an attempt to smear China.”

The Citizen Lab analysts found more than 100 domains targeting at least a dozen individuals with the aim of stealing credentials, most likely to enable further surveillance, device compromise and coordinated harassment campaigns.

ICIJ spoke to some of the targets, including a Taiwanese foreign ministry official, who was approached by someone impersonating an ICIJ reporter. The imposter told the official that his contact information was provided by “headquarters” — a term journalists generally don’t use.

Citizen Lab found several errors suggesting that the attackers may have been involved in a “high volume” of attacks and used artificial intelligence to automate them, identify targets and generate messages without much oversight.

“It’s yet again a confirmation that the Chinese state continues to be deeply concerned about controlling the narrative about itself overseas and repressing, surveilling or harassing individuals who are challenging their preferred narrative,” said Emile Dirks, a researcher of Chinese surveillance and contributor to the Citizen Lab report.

https://www.icij.org/investigations/china-targets/cyberattack-against-uyghur-rights-activists-shows-hallmarks-of-chinese-repression-tactics-researchers-say/

Digital repression Cyberattack against Uyghur rights activists shows hallmarks of Chinese repression tactics, researchers say Apr 28, 2025

https://www.icij.org/investigations/china-targets/china-transnational-repression-dissent-around-world/

OVERVIEW Inside China’s machinery of repression — and how it crushes dissent around the world Apr 28, 2025

https://www.icij.org/investigations/china-targets/interpol-red-notice-police-warrant-jack-ma/

INTERPOL Chinese authorities exploited Interpol and strong-armed one of the world’s richest men to pursue a target Apr 29, 2025

Recommended reading Digital repression Cyberattack against Uyghur rights activists shows hallmarks of Chinese repression tactics, researchers say Apr 28, 2025 OVERVIEW Inside China’s machinery of repression — and how it crushes dissent around the world Apr 28, 2025 INTERPOL Chinese authorities exploited Interpol and strong-armed one of the world’s richest men to pursue a target Apr 29, 2025

ping a persona and developing a story they think is enticing to you, on the technical level, they basically had that OAuth phishing kit to try and get into and like that was it,” Brown said.

These limitations suggest the attackers were private contractors in China’s ever-growing commercial hacking industry working for a government agency, according to Brown and a Taiwanese security official interviewed by CommonWealth magazine.

The attack shared similarities with another type of campaign called spear phishing, which cybersecurity analysts previously attributed to Chinese state-sponsored actors who target people with personalized messages to trick them into divulging sensitive data.

“In the case of state-sponsored credential theft,” the Citizen Lab report said, “the attacker can gain insight into topics of state-interest, spread disinformation via the compromised account, or use the credentials in future attacks against the target or their contacts.”

According to Dirks, the Chinese surveillance researcher, even if the attack is unsuccessful, campaigns like these can have a “chilling effect.”

“It sends a message to people like yourself and your colleagues, to members of diaspora communities, to human rights organizations that they are being watched, they are being monitored and that they are in the crosshairs of Beijing.”

 

Digital transnational repression

Digital transnational repression — the use of online technologies for targeted intimidation, threats and surveillance — is a common weapon in the hands of autocratic regimes such as China and Russia, according to a recent European Parliament study. In China, hackers-for-hire compete to support the government’s cyber operations, from monitoring negative social media posts to selling spyware, phishing kits and other offensive cyber tools.

Last year, ICIJ and its media partners interviewed more than 100 targets of Beijing’s repression and found about half of them had been victims of online smear campaigns, hacking attempts, or phishing campaigns seeking to steal their information.

Among them was Jiang Shengda, a Paris-based artist and activist whose family in Beijing has often been visited and interrogated by Chinese security officials demanding that Jiang stop his activism.

Jiang Shengda, a Beijing-born activist now living in France. Image: Maxime Tellier / Radio France

After ICIJ exposed details of the officials’ intimidation tactics against Jiang’s family last year, the activist noticed an uptick in cyberattacks targeting his email account.

Jiang, who also collaborates with a Chinese dissident considered a “key individual” — or threat — by Beijing, said he receives about two to four phishing emails a day from accounts mimicking supermarket chains or postal services.

Jiang said he has informed European authorities about the “harassment” campaign against him and now helps other Chinese dissidents protect against cyber threats.

“This is not just a personal issue,” he said, “but a pressure shared across the entire community.”

For Brown and her team at Citizen Lab, the work isn’t over.

They will continue to collect evidence about attacks and perpetrators, hoping to inform the public as well as policymakers and government leaders, Brown said.

“By more people knowing that this is a coordinated effort and it’s not isolated, we’ll be able to connect more dots and identify what’s actually going on,” she said. “That will help us both to prevent and detect it better, but also it will give people in leadership maybe some way to hold accountability.”

Note: ICIJ staff email addresses include the domain icij.org. If you believe an ICIJ impersonator has approached you, please do not engage and notify us at contact@icij.org.

A German court has convicted the former co-owner of Panamanian law firm Mossack Fonseca — the subject of the International Consortium of Investigative Journalists’ Panama Papers investigation — for aiding and abetting tax evasion.

Cologne’s regional court sentenced Christoph Zollinger, a Swiss-Panamanian dual national, to one year and nine months’ probation, according to ICIJ’s German partner ZDF. A spokesperson for the court confirmed to ICIJ that the probation period will last for three years.

German prosecutors accused Zollinger and accomplices of establishing offshore companies based in Panama and other tax havens in exchange for payment, which the court determined was done “on a massive scale” and “in a factory-like manner.”

https://www.icij.org/investigations/panama-papers/swiss-lawyer-from-panama-papers-firm-to-face-court-on-tax-evasion-charges/

Offshore finance Swiss lawyer from Panama Papers firm to face court on tax evasion charges Nov 28, 2025

https://www.icij.org/investigations/panama-papers/ten-years-after-the-panama-papers-enablers-and-tax-cheats-are-still-being-brought-to-justice/

IMPACT Ten years after the Panama Papers, enablers and tax cheats are still being brought to justice Apr 02, 2026

https://www.icij.org/investigations/panama-papers/judge-orders-nazi-looted-modigliani-linked-to-panama-papers-be-returned-to-heirs/

IMPACT Judge orders Nazi-looted Modigliani linked to Panama Papers be returned to heirs Apr 06, 2026

Recommended reading Offshore finance Swiss lawyer from Panama Papers firm to face court on tax evasion charges Nov 28, 2025 IMPACT Ten years after the Panama Papers, enablers and tax cheats are still being brought to justice Apr 02, 2026 IMPACT Judge orders Nazi-looted Modigliani linked to Panama Papers be returned to heirs Apr 06, 2026

Lawmakers and experts in several countries have called for pharmaceutical companies to be more transparent about drug pricing and tax dealings following revelations from ICIJ’s Cancer Calculus.

The investigation, led by ICIJ and 47 media partners, explores how Merck & Co. — known as MSD outside the United States and Canada — keeps huge revenues flowing while pricing out many patients and governments from its blockbuster cancer drug Keytruda.

ICIJ’s investigation revealed that Merck operates with a gross lack of transparency in pricing, even as the cost of Keytruda strains public health systems and counterfeiters reap massive windfalls from duping the expensive drug. The findings have so far elicited widespread reactions from politicians, government agencies, and health and financial accountability experts.

Merck’s tax maneuvers highlighted in the U.S.

The international collaboration found that Merck reduced its U.S. taxes by recording profits in lower-tax jurisdictions. In its 2025 annual report, Merck disclosed it paid around $1.6 billion in U.S. income taxes, compared to $4.5 billion in other countries.

At a U.S. congressional hearing on corporate taxation on Tuesday, Zorka Milin, head of the Financial Accountability and Corporate Transparency Coalition, confirmed those findings.

“Despite making more than half of its sales at outrageous prices to American customers, Merck paid more taxes to Switzerland than it did to the U.S.,” Milin said at the Democrat-led hearing. “For decades, major American pharma companies have been moving their profits and sometimes also their factories overseas. Their customers are mostly American, their intellectual property is developed here with support of American tax dollars, but somehow their profits are Irish, Swiss, Dutch.”

https://www.icij.org/investigations/cancer-calculus/merck-keytruda-cancer-drug-price/

OVERVIEW How Merck turned its wonder drug into a blockbuster — and priced out cancer patients worldwide Apr 13, 2026

https://www.icij.org/investigations/cancer-calculus/a-burgeoning-black-market-inflated-dosing-and-the-over-judicialization-of-health-care-reporters-around-the-world-tell-stories-about-keytruda/

PARTNER STORIES A ‘burgeoning black market’, inflated dosing and the over-judicialization of health care: reporters around the world tell stories about Keytruda Apr 21, 2026

https://www.icij.org/investigations/cancer-calculus/report-mercks-blockbuster-cancer-drug-topped-200000-a-year-under-trump/

KEYTRUDA Report: Merck’s blockbuster cancer drug topped $200,000 a year under Trump Apr 17, 2026

Recommended reading OVERVIEW How Merck turned its wonder drug into a blockbuster — and priced out cancer patients worldwide Apr 13, 2026 PARTNER STORIES A ‘burgeoning black market’, inflated dosing and the over-judicialization of health care: reporters around the world tell stories about Keytruda Apr 21, 2026 KEYTRUDA Report: Merck’s blockbuster cancer drug topped $200,000 a year under Trump Apr 17, 2026

Groot (Het Financieele Dagblad), Kristof Clerix (Knack), Joël Matriche⁩ (Le Soir), Stefan Melichar (profil), Minna Knus-Galán⁩ (Yle), Isabella Cota and Brenda Medina (ICIJ)

Update April 27, 2026: This story was updated to clarify that Belgium’s reported spending on Keytruda reflects gross expenditure rather than the net price.