Over the past three (3) years, a Chinese cyber-espionage organization has been consistently launching credential theft operations against humanitarian agencies, think tanks, and government organizations. Tracked as RedAlpha, this threat group often targets religious minority communities against the Chinese State. Throughout these campaigns, threat actors registered hundreds of domains in an effort to spoof legitimate domain names and compromise unsuspecting victims. In 2021 alone, over 350 typosquatted domains were registered to the RedAlpha organization. Several techniques were observed from the domain structuring such as consistent naming conventions, use of virtual private server (VPS) hosting from VirMach, and consistent use of “*resellerclub[.]com” nameservers. When RedAlpha phishing operations are launched, victims are redirected to a fake login portal mimicking specific organizations where user credential pairs were exfiltrated to RedAlpha actors after submission. Recent phishing campaigns launched by RedAlpha have been observed using the same tactics, techniques, and infrastructure as their previous attacks; security teams should note applicable indicators of compromise and update security controls to lessen the risk of threat actor compromise. CTIX continues to track threat actors globally and will provide additional updates accordingly.