The FBI has taken down 13 websites linked to a covert Chinese intelligence operation aimed at secretly hiring current and former US government employees and military personnel to extract classified information under the guise of consultancy roles.
These websites, created between late 2023 and late 2025, masqueraded as legitimate consulting firms and even a nonprofit organization. In reality, federal investigators say, they served as fronts to lure Americans with job offers and payments in exchange for sensitive data about China-related topics.
The domains carried names like Centrik Global Consulting and Gulf Peace Foundation and utilized fraudulent or stolen identities with AI-generated photos to enhance their credibility. They advertised consulting jobs suggesting their bases were in locations such as London or Singapore, but they were orchestrated internationally by operatives linked to China.
According to a detailed FBI affidavit, two individuals, referred to as Subject A and Subject B, were behind the scheme. Subject A, previously residing in South Africa, recruited at least seven Americans between September and November 2024, soliciting reports on topics connected to China. Subject B is believed to be a real person originally from the Caribbean who has lived or lives in China.
Investigators tied these operations to Chinese intelligence using IP addresses linked to LinkedIn and Gmail accounts involved in the recruitment attempts. The conspirators spread across countries including China, Hong Kong, Macau, South Africa, and the UK, and paid for domain registrations through international financial transfers.
The Justice Department seized these domains through court orders in an effort to disrupt this foreign espionage method. However, officials warned this action will not prevent the creation of new fake sites, urging US government and military personnel to remain vigilant against deceptive recruitment tactics on job platforms like LinkedIn, Indeed, and Upwork.
This operation highlights a growing trend of state actors using online job offers to exploit insiders who have access to protected information, underscoring the need for heightened awareness and counterintelligence measures among US personnel.