Post

1/ In Feb 2026, OpenAI reported on a doxxing website, which since 2023 had been exposing Chinese activists and dissidents. Unsurprisingly, the company attributed that activity to Chinese law enforcement. We @citizenlab.ca had been looking at it for a while and have some extra details. 🧵

openai.comDisrupting malicious uses of AIOur latest threat report examines how malicious actors combine AI models with websites and social platforms—and what it means for detection and defense.

Alberto Fittarelli

@fittarelli.com

2/ The domain revealscum[.]com was registered in 2023 and became active almost immediately. It followed a playbook we have already described that same year in our report on HKLEAKS. Exposing as much private information as possible, framing it in the most damaging way for the target.

citizenlab.caBeautiful Bauhinia: "HKLeaks" – The Use of Covert and Overt Online Harassment Tactics to Repress 2019 Hong Kong Protests - The Citizen LabIn August 2019 a wave of websites and social media channels, called “HKLEAKS,” began “doxxing” the identities and personal information of pro-democracy activists in Hong Kong. While the creators of th...

11/8/26, 9:49 am0 reposts1 like

Alberto Fittarelli

@fittarelli.com

11 Aug

3/ OpenAI identified it as part of a much larger effort to target dissidents (and the Japanese PM), revealing the enormity of its scale in terms of human and technological resources deployed by the actors.

Alberto Fittarelli

@fittarelli.com

11 Aug

4/ "Reveal Scum", the contents of which I won't show, followed the HKLEAKS playbook almost to the letter. Completely anonymous, with good operational security. A couple of generic Wordpress usernames ("Autumn" and the Chinese equivalent for "admin"). Anonymous hosting on US and Canada-based infra.

Alberto Fittarelli

@fittarelli.com

11 Aug

5/ But like for HKLEAKS, they made mistakes. For about a month and a half in 2023, the website resolved to the same IP address as just 1 domain. Gem Herald [WARNING: open with caution] claims to offer Australian audiences "Real Aussie news. No fluff." It's also flagged for malware by Maltrail:

6/ A closer look reveals another familiar playbook: that of PAPERWALL. A "local news" site in fact channeling anti-dissident harassment and pro-PRC, unsourced "op-eds", mixed with the unattributed lifting of real articles from actual international media to lend credibility to the whole thing.

citizenlab.caPAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content - The Citizen LabA network of at least 123 websites operated from within the People’s Republic of China while posing as local news outlets in 30 countries across Europe, Asia, and Latin America, disseminates pro-Beiji...