In a major counterintelligence move announced Wednesday by the U.S. Department of Justice, the Federal Bureau of Investigation has taken control of more than a dozen fraudulent websites that U.S. officials claim form part of a Chinese government scheme to target U.S. workers with access to classified and sensitive national security information.
According to law enforcement, all 13 seized domains were designed to impersonate legitimate consulting firms, posting deceptive job advertisements targeted specifically at current and former U.S. government employees who hold active security clearances. Behind this polished facade, every fake company and every job listing was a carefully constructed ruse to lure insiders into sharing sensitive data, officials confirmed.
This domain seizure is the latest step in a coordinated push by Western law enforcement and intelligence communities to raise public awareness of what agencies describe as an ongoing, widespread campaign by Chinese intelligence to recruit clearance-holding personnel. The coordinated warning effort gained momentum last week, when the Five Eyes intelligence alliance — an English-speaking partnership grouping Australia, Canada, New Zealand, the United Kingdom, and the United States — released a joint public bulletin cautioning that China is systematically targeting workers from all five member nations through mainstream job platforms to illicitly gain access to classified information.
That bulletin detailed that operatives linked to Chinese military intelligence routinely pose as staff for private sector companies or independent think tanks. They advertise non-existent positions, ranging from foreign policy to defense analysis roles, and pressure job applicants to turn over non-public information as part of the application and hiring process.
Court documents connected to the seizure, an FBI affidavit laid out how the scammers built credibility for the fake websites: they used stolen and falsified identities for company leadership, and deployed AI-generated images to create a false sense of legitimacy. All of the posted roles were generic consulting positions tailored to attract the interest of current and former U.S. government workers with clearance access. The affidavit also noted that these fraudulent websites are often promoted and linked in job postings placed by the scheme’s operators on mainstream professional hiring platforms such as LinkedIn.
The Department of Justice added that applicants who responded to the fake listings were offered financial compensation in exchange for writing reports tied to their previous government work — and ultimately, for turning over sensitive classified information. Operators behind the plot, who U.S. officials allege have direct ties to Chinese intelligence services, use cryptocurrency and untraceable online payment systems to conceal their true identities and hide the financial transactions compensating recruits, according to official statements.
Investigators first identified the fraudulent network after multiple targeted individuals came forward to report suspicious interactions they had experienced. Dan Wierzbicki, special agent in charge of the FBI Washington Field Office’s counterintelligence and cyber division, explained in an interview that much of the breakthrough intelligence came from interviews with members of the clearance-holding community who flagged unusual activity.
“ A lot of this information came from doing interviews, interviews with people who came forward that something didn’t seem right, ” Wierzbicki said. “ They provided information and said, ‘Hey, this is kind of weird, we’re kind of getting paid by a cryptocurrency or an online payment system that’s not typical. ’”
Wierzbicki also confirmed that the FBI assesses there are additional undiscovered websites operating with the same malicious purpose, and is asking members of the public — particularly clearance-holding current and former government personnel — to report any suspicious job solicitations to help the agency identify and shut down the remaining platforms.
In response to the allegations, a spokesperson for the Chinese Embassy in Washington dismissed the claims of Chinese government-backed espionage as “entirely fabricated” and “malicious slander.”
Associated Press journalist Didi Tang contributed additional reporting from Washington for this story.