Bill Hartzer posted about a "new undetectable negative SEO tactic" last week, which was a pretty significant blog post title to use because it is a very strong accusation. First, we've covered the topic of redirecting penalties from bad sites to new sites several times, including the canonical method - so the concept of negative SEO through canonicals is not really new. But even more so, Google's messaging about using this tactic has said no, it doesn't work as a negative SEO tactic (although, the messaging has been confusing around this in the past to be fair).
Bill explains that you have a victim site and a bad site, the bad SEO copies the head of the victim site and put it on the bad site and then use the canonical tag to point the bad site to the victim site. Bill says then Google will combine the two sites and the result will be that the site gets hurt because of it. You can read more about those details on his blog, but most of you probably read about this prior elsewhere.
John Mueller from Google responded that first that is not how canonicals work they do not combine signals:
The premise that rel canonical combines pages is wrong. That's not how it works, it's either one or the other.
— John ☆.o(≧▽≦)o.☆ (@JohnMu) April 21, 2018
He also said that people have tried things like this with canonicals, it has been around for years, and Google is aware of what people might want to try to do to their competitors.
The rel canonical has been around for over a decade, people have tried lots of things with it. It's a signal for canonicalization; one URL wins, the others' crawls get dropped.
— John ☆.o(≧▽≦)o.☆ (@JohnMu) April 22, 2018
Anyway, there has always been a debate about negative SEO and here it just it going on again.
Forum discussion at Twitter.
Update: John Mueller calls all of this speculation "nothing."
You're making a mountain out of nothing, Roger.
— John ☆.o(≧▽≦)o.☆ (@JohnMu) April 24, 2018