FBI warns of Chinese virtual recruitment espionage
The FBI details how foreign intelligence services, especially China, use fake online job offers to recruit U.S. insiders for espionage.
Sourcefbi.gov — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The FBI's Counterintelligence and Espionage Division has published guidance warning about "virtual targeting," a recruitment tactic used by foreign intelligence services to identify and cultivate insider sources through professional networking sites, social media, and freelance job platforms. Operatives pose as consulting firm representatives or researchers, initially requesting harmless open-source analysis work, then gradually escalating to requests for sensitive or classified information while increasing payments and moving communications to encrypted apps and cryptocurrency or peer-to-peer payment methods to avoid detection.
The article highlights the case of Korbein Schultz, a former U.S. Army intelligence analyst sentenced to seven years for transmitting at least 92 sensitive military documents to a China-based individual posing as a geopolitical consulting client. The relationship was conducted entirely online via a freelance work platform and commercial messaging apps, with payment through online platforms, illustrating how adversaries avoid face-to-face contact entirely while building trust and extracting increasingly sensitive material over time.
This is a counterintelligence awareness advisory rather than a report on an active malware campaign or technical exploit. It targets current and former U.S. government employees, military personnel, contractors, and cleared individuals, urging vigilance against unsolicited remote consulting offers and encouraging reporting of suspected foreign contact to the FBI.
Mentioned in this report
Source reporting: https://www.fbi.gov/news/stories/foreign-virtual-targeting
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs