Five Eyes Warns China Is Recruiting Insiders Through LinkedIn and Gig Platforms
The Five Eyes intelligence alliance has warned that Chinese military intelligence services are using professional networking, recruitment, and freelance platforms including LinkedIn, Indeed, and Upwork to identify and cultivate people with access to sensitive government and military information. According to the joint bulletin, Chinese operatives pose as recruiters, consultants, think tanks, or HR firms, then build relationships with targets and gradually request increasingly sensitive reporting. The campaign is aimed not only at security clearance holders and active military personnel, but also at academics, journalists, freelance writers, think tank staff, and others whose unclassified knowledge of policy, strategy, capabilities, or installations can be combined into actionable intelligence.
The advisory says communications often shift from mainstream platforms to encrypted messaging apps, while payments may be routed through services such as PayPal, Zelle, Wise, Western Union, and cryptocurrency. Officials said some targets have already provided information, leading in some cases to criminal prosecutions, revoked security clearances, and job losses. The warning builds on earlier MI5 alerts, including concerns about Chinese approaches to parliamentarians and a prior estimate that roughly 10,000 Britons were targeted over five years, while similar tactics have also been reported in the United States through fake consulting firms seeking information from former federal workers.

Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
3 events from the most recent confirmed update back to the earliest known activity.
Five Eyes issues joint 'Safeguarding our Secrets' bulletin
The Five Eyes intelligence alliance issued a joint bulletin warning that Chinese military intelligence services are using LinkedIn, Indeed, Upwork, and similar platforms to recruit government and military insiders in Western countries. The advisory described a multi-step scheme in which operatives pose as recruiters or consultants and solicit increasingly sensitive non-public information.
MI5 warns Parliament about Chinese LinkedIn targeting
MI5 previously warned that Chinese agents had used LinkedIn and similar recruitment approaches to target members of parliament and parliamentarians.
MI5 estimates 10,000 Britons were targeted over five years
An earlier UK alert cited by The Register said that by 2021, around 10,000 Britons had been approached over a five-year period as part of Chinese intelligence-linked recruitment efforts.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
11 references tracked. Mallory keeps watching after this page renders.
Chinese Spies Using LinkedIn, Job Sites to Recruit Western Workers
techrepublic.com
Open sourceChina is using recruitment sites to buy top secret information - Boing Boing
boingboing.net
Open sourceChina-linked actors using job sites to target government workers, Five Eyes warns | brief | SC Media
scworld.com
Open sourceFive Eyes warn Chinese spies are using job sites to recruit insiders | The Record from Recorded Future News
therecord.media
Open sourceFive Eyes Joint Bulletin - Safeguarding Our Secrets | MI5 - The Security Service
mi5.gov.uk
Open sourceGot a LinkedIn message from a recruiter? It might be Chinese intelligence, warn FBI and MI5
bitdefender.com
Open sourceUk Government
mi5.gov.uk
Open sourceUk Government
mi5.gov.uk
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.


