Facebook removes accounts of Chinese state hackers who attacked Uyghurs

Facebook has taken several accounts of Chinese state hackers offline because they would attack Uyghurs abroad. The hackers allegedly use infected websites and apps to spy on the Uyghurs, as well as journalists and activists.

It concerns a group of hackers known in the security world as Evil Eye. Those hackers are linked to the Chinese state. The group is said to have created Facebook profiles in which the hackers posed as journalists, students or human rights activists. For example, they tried to gain the trust of Uyghurs living in Turkey, Kazakhstan, the US, Syria, Australia and Canada. China has suppressed this ethnic minority group for years.

After the hackers had won the trust of the victims, they tried to phish them. The hackers built news websites that installed the Insomnia malware on iPhones and mimicked Google’s Play Store where victims could download keyboard or dictionary apps that downloaded the PluginPhantom and ActionSpy malware.

Facebook says its platforms were used to share links, but it’s not clear how that happened. According to Facebook, the hackers carried out sophisticated attacks and managed to hide who was behind the attacks. It is unknown exactly how many accounts have been deleted.