US seizes 13 domains in alleged Chinese spy recruitment scheme

Federal authorities seized 13 internet domains that they said were used to target current and former U.S. security clearance holders with access to classified and sensitive government information. The websites posed as legitimate consulting firms, offering vague, well-paid work and then pushing applicants to hand over insider information. The case underscores how foreign intelligence recruitment can hide inside routine online networking and ordinary job searches.

The Justice Department said the campaign began in November 2023 and relied on a set of shell businesses with names including Centrik Global Consulting, Rightinfo Consulting, Finnacle-Vesper Consulting, CYDF Consulting, Pulse Wave Global, Catalyst Global Solutions, Horizzen, GeoIndopacific and SafeSec Group. The roles advertised through job-market platforms and freelance sites included titles such as Senior Analyst and International Affairs Consultant, a pitch designed to look like standard professional recruiting rather than a collection effort. Prosecutors said the operation also used encrypted messaging apps, cryptocurrency and overseas payment accounts registered under false names.

Investigators said the operators built credibility with AI-generated content, AI-generated photographs, aliases, fake personas and stolen identities. The FBI said that combination made the companies appear real enough to lower suspicion and widen the pool of targets, especially among people with access to policy, military and government information. The approach reflects a shift in espionage tradecraft, one that leans less on technical intrusion alone and more on social engineering, professional branding and the trust signals embedded in online hiring.

The seizures came after the Five Eyes intelligence alliance, through agencies including ASIO, CSIS, the FBI, MI5 and NZSIS, released a bulletin on June 3 warning that China’s military intelligence services were using Western professional networking sites and job platforms to reach people with privileged access. MI5 said the bulletin, Safeguarding Our Secrets, warned that Chinese intelligence officers were posing as recruiters and consultants through fake cover companies outside China.

U.S. officials framed the takedown as both a disruption and a warning. Assistant Attorney General for National Security John A. Eisenberg said the seizures showed how foreign actors use promises of easy money to lure Americans into revealing information they are duty-bound to protect. Roman Rozhavsky, the FBI’s counterintelligence chief, said the bureau had observed China’s intelligence services using AI, professional networking sites and online payment platforms to target Americans. U.S. Attorney Jeanine Ferris Pirro said the sham sites were built to deceive, while Daniel Wierzbicki said they were being used to exploit U.S. government employees behind fake companies and phony job postings.