Kazim AlamChinese intelligence agencies are allegedly using professional networking platforms like LinkedIn to recruit foreign professionals with access to sensitive information.
A large number of cases reported over the last many years show that what usually begins as an unsolicited job offer or a conference invitation with a free hotel stay soon turns into an entrapment.
The recruitment scheme blends legitimate-sounding, short-term gigs offered by seemingly reputed organisations with growing demands for privileged information accessible to only a few.
Experts say the sheer scale of these operations has dramatically lowered the long-standing cost and logistical barriers for espionage.
Mark Button, co-director of the Centre for Cybercrime and Economic Crime at the UK’s University of Portsmouth, tells TRT World that there have been “thousands of fake adverts” that shady recruiters have posted to lure individuals into espionage.
“They normally target very useful people… working in intelligence or research and development in key industries. (They) start off with consultancy or a job… leading towards engaging in espionage,” he says.
The digital approach marks a significant evolution from traditional espionage, which was slower and more expensive.
Nurettin Akcay, a Turkish academic with a PhD from Shanghai University’s Global Studies Department, tells TRT World that Chinese intelligence effectively uses two main methods for spy recruitment.
The first method involves engaging targets visiting China, like students, academics, diplomats, or businesspeople.
“The second most common method is to identify and contact targets through specific job search apps or social media accounts. The most prominent platform here is LinkedIn,” he says.
Akcay points to official endorsements of this tactic.
In a 2022 joint statement, the FBI in the US and MI5 in the UK warned that China was conducting cyber espionage on a massive scale through social media apps.
Earlier this week, the FBI shut down over a dozen websites allegedly used by Chinese agents to recruit US officials with security clearances.
These sites represented fake consulting companies, targeting individuals with job postings for different roles such as “International Affairs Analysts (Remote)” and “Defence Analyst”.
Recruiters reportedly used AI-generated photos, identity theft, and payments for research reports to obtain sensitive information on topics like US-China relations, particularly sanctions mechanisms.
The Five Eyes intelligence alliance – comprising the US, the UK, Canada, Australia, and New Zealand – recently warned professionals against Chinese military intelligence operatives posing as employees of consultancies and think tanks to target foreign policy and defence analysts.
Potential recruits, including those with security clearances, are often asked to produce “trial reports” as a gateway to deeper involvement.
China has condemned the warning by the Five Eyes intelligence alliance, saying its accusations are “purely false” and “malicious slander”.
Potential red flags
Experts urge professionals to watch out for specific tactics used by shady recruiters.
Button points to certain profile characteristics and approach patterns.
“Some of the key things are that they will have someone who looks attractive, often an attractive woman. They’ll obviously have very strong connections to very prestigious organisations,” he says.
They likely have limited professional networks and readily extend unsolicited offers, including conference invites, job opportunities, or payments for report writing.
“Any kind of unsolicited approach where it immediately starts moving into ‘would like you to speak at a conference or offer you a job or some kind of payment’ is a red flag,” Button warns.
Akcay noted that targets are rarely approached as spies.
Instead, recruiters position themselves as academics offering consultancy, engineers as research partners, or retired officials sharing ideas.
Chinese intelligence often establishes front consulting or research companies, he says.
Academics receive invitations to China for collaborations or conferences, sometimes routed through university-affiliated centres before connections to the intelligence community emerge, he notes.
“Once trust is established, they are gradually directed towards sensitive areas,” Akcay says.
Initial requests involve innocuous reports, followed by payments that create a sense of obligation.
“The person who takes the first assignment and accepts payment becomes a strong candidate for Chinese intelligence. And gradually, the information requested from the target becomes more sensitive,” he says.
Techniques include reciprocity through small favours and symbolic gifts, or framing requests as legitimate academic inquiries to enable rationalisation, he adds.
Co-authored by Button, a recent research paper on economic espionage via fake social media profiles in the UK lists typical responses to job portal connection requests.
Based on a survey of 2,000 professionals, it said a quarter were ill-prepared to use social media for professional purposes, as they often accepted risky link requests.
Homophily-oriented individuals – ones who instinctively prefer to associate with people with similar backgrounds – tend to reject suspicious profiles.
In contrast, the survey showed that heterophily-oriented people – ones who readily bond with individuals from different backgrounds – are more susceptible to such networking requests.
Who are the primary targets?
Experts say that target sectors may vary by country, but certain areas face intense pressure.
Button identifies senior intelligence and government roles, defence R&D in cutting-edge weapons and technologies, and finance for insider information on company performance.
Akcay highlights technology as the top priority, driven by policies such as “Made in China 2025,” which aim to achieve self-sufficiency in emerging technologies like AI.
In defence, smaller subcontractors are preferred due to their weaker security protocols, he says.
Finance is a secondary target, focused on sanctions mechanisms and policy insights.
In regions like the Middle East and Africa, policymakers are key targets of Chinese spy recruitment schemes, he says.
Social media-focused methods now clearly outperform traditional recruitment for spies.
For example, an intelligence recruiter in the past would laboriously identify a chief R&D officer at a private company before approaching them.
But that long and tedious process has now been reduced to a few instant LinkedIn searches today, Button says.
“LinkedIn and comparable social media have just made it much easier to find these individuals… I would expect the kind of penetration to be much bigger than 20 years ago,” he says.
A media professional from India tells TRT World that he was approached on LinkedIn by a “global expert network company” for a “brand perception research project”. The gig promised $300 an hour.
“I felt something was off, maybe because I had read about such recruitment schemes. I turned it down, even though it could have been a legitimate offer,” says the man requesting anonymity.
Akcay claims that almost “all foreign targets” are being acquired via online platforms these days.
Referring to the US Department of Justice cases from 2015 to 2023, he says most initial contacts were made via LinkedIn or similar sites.
Similarly, MI5 has reported that more than 20,000 UK individuals were approached on LinkedIn in recent years “in the hope of stealing industrial or technological secrets”.
“Traditional methods required physical contact, fake identities, and long-term field operations. However, digital platforms have almost eliminated this cost,” Akcay says.
