The US Dept of Justice on Monday, March 25, 2024 announced Seven Hackers Associated with Chinese Government Charged with Computer Intrusions Targeting Perceived Critics of China and U.S. Businesses and Politicians It includes the following passage:

The malicious emails contained hidden tracking links, such that if the recipient simply opened the email, information about the recipient, including the recipient’s location, internet protocol (IP) addresses, network schematics, and specific devices used to access the pertinent email accounts, was transmitted to a server controlled by the defendants and those working with them.

I'm aware of possible tracking via embedded images and have "show images" turned off in Gmail. Besides those, what are the most common forms of "hidden tracking links" in email messages that compromise electronic devices, and does "if opened" refer to simply opening of the email, or to then opening of the hidden link itself somehow?

The reason I'm asking is that I do receive occasional emails from sources I question but for which I would still like to see the text they contain, and not sure if gmail is flagging/removing these "hidden links" or how to look out for them.

  • 1
    Always, always check the original sources that news outlets summarise. Journalists often misquote or conflate details. The NYT said that the links compromised devices. But that's not what the DoJ said ... The DoJ said that the links gathered info that was then used to attempt to compromise accounts and even devices... Big difference there...
    – schroeder
    Commented Mar 26 at 10:11
  • 1
    NYT is often good about this sort of thing, but digital tech is very complex and journalists are not technologists. So, when you want to understand the technical details, always go to the source to check. The DoJ could simply mean a tracking pixel, which is a "link" to an external image resource. It's a poor use of the term "link" but it also doesn't need to be anything more advanced than that.
    – schroeder
    Commented Mar 26 at 10:15
  • 1
    @Adamkatz unfortunately, there's no confirmation that the "link" was an external image. That's just a guess from the incomplete info from the DoJ report. This question is "what other kinds are there?"
    – schroeder
    Commented Mar 26 at 22:02
  • 1
    @AdamKatz oh, I can't think of another method, either, but your duplicate isn't an answer to the question asked, which would be "nope, just pixel trackers"
    – schroeder
    Commented Mar 26 at 22:11
  • 1
    Okay, that's fair. I was on the fence about just linking as opposed to voting to close.
    – Adam Katz
    Commented Mar 26 at 22:31

1 Answer 1


Having tracking links that perform a request to a server when the email is opened is normally not possible. Embedded images is indeed the most common way to track whether users opened an email, but that is indeed prevented by most clients by blocking these images.

However, a recent bug in Outlook made it possible to bypass the link validation algorithm, and even execute arbitrary code on the client. So this sounds like it conforms to the quote from the DoJ.

There doesn't seem to be sufficient information available to know for sure, but it seems that the attackers exploited a email-client bug, not a standard feature.

  • I corrected the OP's question. The DoJ never said that the links compromised systems. Only gathered info. Compromise was a subsequent step.
    – schroeder
    Commented Mar 26 at 10:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .