China fake job recruitment espionage has escalated into a coordinated campaign targeting current and former US military, intelligence, and government personnel through deceptive online hiring tactics. The FBI and Five Eyes intelligence partners are now publicly warning that Chinese military intelligence services are using increasingly sophisticated fake job postings, fake consulting firms, and professional networking platforms to lure government employees into revealing sensitive information.
Key Takeaways
- Chinese intelligence operatives pose as recruiters and consulting firms on LinkedIn and job platforms to target government workers.
- A network of five fake companies—Smaio Intelligence, Dustrategy, RiverMerge Strategies, Tsubasa Insight, and Wavemax Innov—operated from the same Tencent-hosted server.
- The campaign received over 400 résumés from American military and federal workers in a previous iteration.
- Warning signs include remote work offers with unusually high pay, flattery, artificial urgency, and vague company details.
- Foreign adversaries including Russia also use LinkedIn, TikTok, Reddit, and RedNote to identify targets with security clearances.
China’s military intelligence services are using an aggressive online recruitment strategy to acquire what intelligence officials call privileged military, political, and economic intelligence that provides strategic advantage. The tactic works because it exploits a predictable vulnerability: government and military workers who have been laid off or are seeking new employment often turn to mainstream job boards and LinkedIn, where they encounter what appear to be legitimate consulting and staffing firms. These fake entities typically target professionals with government backgrounds, offering remote positions in policy analysis, defense strategy, or foreign affairs—fields where access to sensitive information is valuable.
How China’s Fake Recruitment Network Operates
The Foundation for Defense of Democracies identified a coordinated network of five companies used in one major campaign: Smaio Intelligence, Dustrategy, RiverMerge Strategies, Tsubasa Insight, and Wavemax Innov. Smaio is a real company based in China, while the other four were fabricated shell operations apparently created by Smaio affiliates. All five domains were hosted on the same server between December 2024 and March, and that server was owned by Tencent, a major Chinese technology company. RiverMerge Strategies, one of the fake firms, posted on LinkedIn seeking professionals with government experience and recruiters with strong networks in Washington, D.C.. In an earlier campaign, a similar fake consulting company received more than 400 résumés from American military and other sensitive federal workers.
The sophistication of these operations lies not in technical deception but in social engineering. The fake firms use legitimate-sounding names, professional websites, and credible job descriptions to appear authentic. They target individuals by name, often flattering them about their background or expertise, and create artificial urgency around hiring decisions. The goal is to build enough rapport that targets willingly share their résumé—which itself contains valuable unclassified information about government operations, agency structure, and career progression—or move into conversations where more sensitive details emerge.
Why This Campaign Targets Laid-Off and Vulnerable Workers
The timing of China’s campaign is deliberate. The Coast Guard Counterintelligence Service warned that foreign adversaries, including China and Russia, are specifically targeting recently fired probationary workers and individuals with active security clearances who are searching for new employment. These workers are psychologically vulnerable—they need jobs, their confidence may be shaken, and they are actively looking at job postings. The Coast Guard identified that adversaries search LinkedIn, TikTok, Reddit, and Xiaohongshu (RedNote) to identify and approach potential sources. A government employee’s résumé alone, even if it contains no classified information, provides valuable unclassified intelligence about the inner workings of US government agencies.
The Coast Guard guidance identifies clear warning signs that distinguish these malicious recruitment attempts from legitimate hiring. Offers that seem too good to be true—remote work with unusually high pay for the role—are a primary red flag. Excessive flattery, artificial scarcity or urgency, lack of depth in company details, and an imbalance in the interaction where the recruiter asks more questions than they answer are all indicators. Legitimate recruiters provide verifiable company information, conduct formal interviews with multiple team members, and maintain professional distance; fake operatives often skip these steps or provide vague responses when questioned.
The Broader Espionage Strategy Behind Fake Job Offers
The FBI and Five Eyes agencies frame this campaign as part of a wider intelligence-gathering effort. China’s military intelligence services ultimately seek to acquire privileged military, political, and economic intelligence that can provide China with strategic and tactical advantage over Five Eyes nations. The deceptive online job offers, and other virtual approaches, have become increasingly sophisticated in targeting unwitting individuals with US government backgrounds who are seeking new employment. This is not a mass phishing scheme or a financial scam—it is a targeted espionage operation designed to identify, vet, and recruit individuals who have access to or knowledge of sensitive government operations.
The campaign differs from traditional spy recruitment in that it requires no dead drops, no clandestine meetings, and no obvious foreign contact. Everything happens through platforms like LinkedIn, where business networking is expected and where a job inquiry appears entirely normal. The fake firms can collect dozens or hundreds of résumés, each one revealing career history, security clearance status, agency assignments, and professional networks. Even without extracting classified information, this metadata provides intelligence value—it maps the structure and personnel of US government agencies in real time.
What Should Government and Military Workers Do?
The FBI and Coast Guard guidance is straightforward: verify any recruiter or firm before sharing personal information. Check company websites independently, not through links provided by the recruiter. Search the company name and recruiter name online to confirm they are real. Request formal interviews with multiple team members and ask detailed questions about company operations, funding, and client base. Be skeptical of remote-only roles with unusually high compensation. If something feels off—vague answers, pressure to move quickly, or flattery that seems excessive—it probably is.
Government employees with security clearances should be especially cautious and should report suspicious recruitment attempts to their agency’s counterintelligence office. The Coast Guard advises that even seemingly innocent job inquiries from unknown sources should be treated with suspicion if the recruiter cannot provide verifiable company information. Sharing a résumé with a fake consulting firm may seem harmless, but it confirms to foreign intelligence services that you have government experience and security clearance—exactly what they are looking for.
How Does This Compare to Other Espionage Tactics?
China’s fake job recruitment campaign represents a shift in espionage tradecraft. Traditional spy recruitment involves identifying targets, building relationships over months, and eventually asking for specific classified information. This approach is slower and riskier. The fake job tactic is faster, scalable, and deniable—a recruiter can claim the job posting was legitimate and the candidate misunderstood. It also exploits the openness of professional networking platforms, which are designed to facilitate job searches and business connections. Russia has adopted similar tactics, searching social media for vulnerable targets. The key difference is that China’s campaign appears more coordinated and sustained, with dedicated infrastructure and multiple fake entities operating in parallel.
Can Legitimate Recruiters and Job Platforms Stop This?
LinkedIn and other job platforms have taken some action to remove fake accounts and fraudulent job postings, but the scale of the problem is substantial. The platforms’ business models rely on open networking and job postings, which makes it difficult to block all malicious activity without also blocking legitimate hiring. The responsibility ultimately falls on individual users to verify recruiters and companies before engaging. Government agencies are also working to educate their personnel about these tactics and to create secure channels for reporting suspicious recruitment attempts.
Is the FBI warning about China fake job recruitment espionage recent?
Yes. The FBI and Five Eyes agencies issued public warnings about this campaign in 2025, with the most recent alerts coming from the Coast Guard Counterintelligence Service and multiple intelligence agencies. The campaign itself has been ongoing, with evidence of activity in late 2024 and early 2025. The public warnings are a response to the increasing sophistication and scale of the operation.
What should I do if I receive a suspicious job offer?
Verify the company independently by visiting their official website directly (not through a link the recruiter provides) and searching for the company name online. Ask detailed questions about the company’s operations, clients, and funding. Request formal interviews with multiple team members. If the recruiter cannot provide verifiable information or the offer seems too good to be true, do not share your résumé or personal information. If you work in government or have a security clearance, report the suspicious contact to your agency’s counterintelligence office.
Why are laid-off government workers being targeted?
Laid-off and recently fired government workers are vulnerable because they are actively job hunting, their confidence may be shaken, and they are less likely to scrutinize job offers closely. Foreign adversaries search LinkedIn, TikTok, Reddit, and RedNote specifically to identify workers with security clearances who are seeking new employment. These workers represent high-value targets because they have recent knowledge of government operations and agency structure.
China’s fake job recruitment espionage campaign represents a fundamental shift in how hostile intelligence services target Western government personnel. It is low-cost, scalable, and difficult to detect until it is too late. The warning from the FBI and Five Eyes is not about a theoretical threat—it is about an active, ongoing operation that has already collected hundreds of résumés from American military and federal workers. The defense is simple but requires vigilance: verify recruiters, check company details independently, and report suspicious contacts to counterintelligence authorities. In an era where espionage can begin with a job posting, skepticism is not paranoia—it is professional security.
Edited by the All Things Geek team.
Source: TechRadar
