Chinese Spy Domain Takedown
FBI and Justice Department Seize 13 Chinese Intelligence-Linked Domains Recruiting Americans
The FBI seized 13 websites on June 10, 2026, that it says were used by Chinese intelligence to recruit American workers with security clearances. The fake sites posed as legitimate consulting firms and advertised high-paying remote jobs for current and former government employees, according to Department of Justice.
The DOJ filed a 78-page affidavit to support the seizure warrants. Federal agents replaced each site's homepage with a seizure banner. Seven Americans were identified in the filing as having been successfully engaged by the fake firms, CNN reported.
Fake Consulting Firms Hunted for Security Clearance Holders
The 13 seized domains included sites like centrikglobalconsulting.com, pulsewaveglobal.com, and gulfpeace.org. They posed as think tanks, nonprofits, and consulting companies. They specifically advertised roles such as "International Affairs Analyst" and "Defense Consultant" — jobs that would appeal to cleared government workers, according to PCMag.
The sites were built between November 2023 and October 2025. Operators used AI-generated photos and stock corporate language to make the firms appear based in neutral cities like London or Singapore. FBI Assistant Director Roman Rozhavsky said AI-generated content was used to "trick and coerce" clearance holders, per Department of Justice.
Federal Layoffs Created a Pool of Vulnerable Targets
The scheme capitalized on recent U.S. government downsizing. Thousands of laid-off federal employees flooded job boards like LinkedIn, Indeed, and Upwork in search of work. To them, a high-paying remote consulting role looked like a lifeline, according to Nextgov/FCW.
Analysts told Recorded Future News the strategy was designed as a "passive-ranking" system. Instead of targeting one person at a time, the fake sites collected thousands of resumes. Intelligence operators could then rank applicants by their level of access to sensitive government data — a more efficient method than traditional spy outreach.
Five Eyes Warning Set the Stage for Seizure Action
One week before the seizure, on June 3, the Five Eyes alliance — the U.S., UK, Canada, Australia, and New Zealand — issued a rare joint bulletin titled "Safeguarding Our Secrets." It warned that Chinese military intelligence was actively using job platforms to recruit assets, The Washington Post reported.
China pushed back hard. Foreign Ministry spokesperson Mao Ning called the Five Eyes bulletin "pure fabrication" and labeled the accusations "malicious slander," according to Anadolu Ajansı. Beijing described the Five Eyes alliance itself as the real threat to global peace.
Cryptocurrency Payments Hid Operators' Real Identities
The operators — identified only as "Subject A" and "Subject B" in the affidavit — used overseas cryptocurrency accounts to send payments to U.S. bank accounts belonging to recruits. The payments were described as "relatively large" in the filing, CNN and Department of Justice reported.
U.S. Attorney Jeanine Ferris Pirro said the seizures send a "clear message" that efforts to exploit trusted Americans will be "exposed and dismantled." Assistant Attorney General John Eisenberg warned that the sites offer a "glimpse" into how foreign actors use "promises of easy money" to lure officials into revealing secrets, per Department of Justice.
Sentiment
Mostly NegativePublishers
18
Articles
162
Reach
180
