Jump to: Citizen Lab Reports External Publications Submissions Op-Eds, Letters, & Comments Books Guides Joint Reports OpenNet Initiative Citizen Lab Reports John Scott-Railton, Rebekah Brown, and Bill Marczak. “Same Sea, New Phish: Russian Government-Linked Social Engineering Targets App-Specific Passwords,” Citizen Lab Report No. 188, University of Toronto, June 18, 2025. Kate Robertson. “Unspoken Implications:… Read more »
Keir Giles, a prominent expert on Russia, was targeted with a new form of social-engineering attack that leverages App-Specific Passwords. Google links the operation to UNC6293, a Russian state-backed group.
On April 29, 2025, a select group of iOS users were notified by Apple that they were targeted with advanced spyware. Among the group were two journalists who consented to the technical analysis of their cases. In this report, we discuss key findings from our forensic analyses of their devices.
Our investigation of a spearphishing campaign that targeted senior members of the World Uyghur Congress in March 2025 reveals a highly-customized attack delivery method. The ruse used by attackers replicates a pattern in which threat actors weaponize software and websites aimed at preserving and supporting marginalized and repressed cultures to target those same communities.
A sustained, coordinated social media harassment and doxxing campaign – which we codenamed JUICYJAM – targeting the pro-democracy movement in Thailand has run uninterrupted, and unchallenged, since at least August 2020. Through our analysis of public social media posts we determined that the campaign was not only inauthentic, but the information revealed could not have been reasonably sourced from a private individual.
Reporting to the Director of Administration, Citizen Lab and working under the general direction of the Director, Citizen Lab in coordination with the University of Toronto’s Chief Information Security Officer (CISO), the Systems and Security Technical Lead is responsible for working with Information Technology staff and resources at Citizen Lab and the wider University to minimize risk of the compromising of information, data, servers, and server-based applications.
The Information Controls Fellowship Program (ICFP) from the Open Technology Fund (OTF) fosters research, outputs, and creative collaboration on repressive Internet censorship and surveillance issues. We welcome proposals from fellowship candidates for research projects related to our current thematic areas.
This profile is part of the Citizen Lab’s research on digital transnational repression. Digital transnational repression arises when governments use digital technologies to surveil, intimidate and silence exiled dissidents and diaspora communities. It is part of the broader practice of transnational repression, which refers to states using methods such as harassment, coercion-by-proxy, kidnapping, and assassination… Read more »
This profile is part of the Citizen Lab’s research on digital transnational repression. Digital transnational repression arises when governments use digital technologies to surveil, intimidate and silence exiled dissidents and diaspora communities. It is part of the broader practice of transnational repression, which refers to states using methods such as harassment, coercion-by-proxy, kidnapping, and assassination… Read more »
This report performs the first public analysis of MMTLS, the main network protocol used by WeChat, an app with over one billion users. The report finds that MMTLS is a modified version of TLS, however some of the modifications have introduced cryptographic weaknesses.
