Chinese intelligence operatives are posing as corporate headhunters on LinkedIn and other professional networking platforms, targeting Western military and government personnel with fake job offers designed to extract sensitive information, the Five Eyes intelligence-sharing alliance has warned.
The scheme works like a slow hook. Operatives create profiles that look like recruiters from private consultancies, think tanks, and human-resource firms. They post openings for foreign-policy or defense-analyst positions. The companies appear legitimate and seem to operate outside China. And the targets, jobseekers with security clearances, military personnel with knowledge of the Indo-Pacific region, often have no idea who they're really talking to.
The warning, reported by Just the News, draws on intelligence from the Five Eyes network, the United States, Canada, Australia, New Zealand, and the United Kingdom. Agencies including the FBI have issued threat bulletins about the activity, and U.S. federal indictments have also publicized aspects of the operation. The practices, according to the reporting, go back decades.
The Wall Street Journal has reported on the mechanics of the scheme. Candidates respond to what appears to be a standard job advertisement. They go through interviews. Then comes the ask: write a "trial report", the kind of deliverable any consulting firm might request from a prospective hire.
That first report is the door. Once the candidate completes it, the recruiters come back with requests for more sensitive material. The payments follow, several thousand dollars per candidate, enough to keep people engaged without raising obvious red flags.
It is a textbook intelligence-recruitment escalation. Start with something harmless. Build a relationship. Introduce money. Then gradually push the target toward material they should never be sharing.
The genius of the approach, from Beijing's perspective, is its deniability. A LinkedIn message from a think tank isn't a dead drop in a parking garage. The target may not realize they've crossed a line until they're already deep into the arrangement.
LinkedIn acknowledged the problem in limited terms. A spokesperson for the platform said:
"We remain focused on detecting state-sponsored abuse, and will continue to enforce our policies against fake accounts."
That statement raises more questions than it answers. How many fake accounts tied to Chinese intelligence has LinkedIn identified? How many has it removed? What detection tools is it deploying, and how effective are they against operatives who have been running this playbook for years?
The platform noted that using false identities violates its terms of service. True enough. But terms of service are not exactly a deterrent to a foreign intelligence agency. Beijing's operatives are not worried about getting their accounts suspended. They are worried about getting caught, and the LinkedIn model, with its vast pool of professionals voluntarily listing their clearances, military experience, and government affiliations, makes their work easier than it has ever been.
The Five Eyes warning is not about a new threat. These activities stretch back decades. What has changed is the tool. Professional networking platforms give Chinese intelligence a scalable, low-risk way to identify and approach targets across the entire Western alliance.
Before LinkedIn, this kind of recruitment required human intelligence officers working embassy circuits, academic conferences, and trade shows. It was labor-intensive. Now a single operative can scan thousands of profiles, filter by clearance level and regional expertise, and send a message that looks no different from any other recruiter's pitch.
The FBI has flagged the threat through its bulletins. U.S. federal prosecutors have brought indictments. But the scope of the problem, how many people have been contacted, how many have responded, how many have crossed the line from an innocent trial report into genuine espionage, remains unclear from available reporting.
The targets are not random. The operatives focus on people with security clearances and military personnel who know the Indo-Pacific region. That tells you where Beijing's intelligence priorities lie. The South China Sea, Taiwan, allied force posture in the Pacific, these are the subjects China's intelligence apparatus wants to understand from the inside.
And the people most vulnerable are often those in career transition. A recently separated military officer looking for private-sector work. A mid-career government analyst exploring options. A defense contractor employee between assignments. These are the people most likely to respond to a recruiter's message, most likely to write a trial report, and most likely to rationalize the next request as just another consulting gig.
The payment structure, several thousand dollars, is calibrated to be attractive without being suspicious. It sits in the range a legitimate consulting engagement might pay. By the time the requests turn sensitive, the target has already accepted money and produced work product. That creates leverage.
A joint warning from the Five Eyes alliance is not routine. The network, built on the post-World War II intelligence relationship between the U.S. and the U.K. and expanded to include Canada, Australia, and New Zealand, reserves coordinated public messaging for threats it considers serious and ongoing.
The fact that all five nations are flagging the same pattern suggests the problem is not confined to one country. Chinese operatives are working across the entire alliance, exploiting the same platforms and the same professional vulnerabilities in each member state.
And the fact that this activity has persisted for decades, surviving multiple rounds of threat bulletins and federal indictments, suggests that the current countermeasures are not enough. Awareness campaigns help. Prosecutions help. But as long as LinkedIn and similar platforms remain open hunting grounds for foreign intelligence services, the recruitment pipeline will keep running.
There is a pattern in Washington's approach to Chinese espionage: sound the alarm, issue the bulletin, bring the occasional indictment, and then move on. The structural problem remains. American professionals voluntarily post their qualifications, clearance levels, and areas of expertise on platforms that foreign intelligence services can search at will.
LinkedIn's statement about enforcing its policies against fake accounts is the corporate equivalent of a shrug. The platform profits from having the largest possible pool of professionals. Every defense analyst, every cleared contractor, every retired military officer on the site is a data point that makes the platform more valuable to legitimate recruiters, and to Chinese intelligence operatives.
The question no one in Washington or Silicon Valley seems eager to answer is whether the convenience of professional networking is worth the counterintelligence cost. The Five Eyes alliance has now told the public, plainly, that Chinese spies are fishing on LinkedIn. The fish are Western military and government personnel. And the bait is a job offer that looks perfectly normal.
When a foreign adversary can recruit spies through the same platform Americans use to find their next job, the problem is not just intelligence. It is infrastructure.
