The US Justice Department and the FBI have seized 13 websites allegedly operated by China-linked operatives to recruit current and former US government employees and extract sensitive information from individuals holding security clearances. The operation, executed on Wednesday, marks one of the most detailed publicly disclosed takedowns of an alleged Chinese intelligence recruitment network targeting cleared personnel.

How the Scheme Operated

According to court documents, the conspiracy began in November 2023, when operatives created at least 13 fictitious consulting company websites along with associated job postings. The sites posed as legitimate firms, advertising roles such as 'Senior Analyst' and 'International Affairs Consultant' while specifically targeting individuals with government, military, and national security backgrounds.

Federal investigators said the operators relied on aliases, stolen identities, and AI-generated photographs to simulate the appearance of credible businesses. Recruits were allegedly pressured to supply 'exclusive' or 'insider' information, with contracts and confidentiality agreements used to lend an air of legitimacy to the fraudulent firms. Payments were routed through accounts linked to fictitious individuals, with cryptocurrency used to obscure the origin of funds, prosecutors alleged.

Platforms Used to Spread the Postings

Job advertisements were placed across multiple social media and employment platforms, including Upwork, Expertia AI, Hubstaff Talent, Wellfound, and Post Job Free. The postings were focused on topics of strategic interest to the People's Republic of China, according to investigators. Communication with recruits was conducted through Telegram and other encrypted applications.

What Officials Said

Assistant Attorney General for National Security John A. Eisenberg said: 'These domain seizures offer a glimpse at how foreign actors can use promises of easy money to lure Americans into revealing sensitive or classified information that they are duty-bound to protect.' He urged anyone approached online with vague consulting offers to treat such overtures with 'extreme caution.'

US Attorney Jeanine Ferris Pirro described the sites as 'crafted to deceive' and said the seizures 'send a clear message that any attempts to exploit Americans trusted with access to our nation's most sensitive information will be exposed and dismantled.'

Roman Rozhavsky, Assistant Director of the FBI's Counterintelligence and Espionage Division, directly attributed the activity to Chinese government intelligence services, stating the seized domains 'illustrate the lengths the Chinese government's intelligence services will go to as they try to use AI-generated content to trick, recruit, or coerce current and former US security clearance holders into sharing sensitive information.'

Daniel Wierzbicki, Special Agent in Charge of the FBI's Washington Field Office Counterintelligence and Cyber Division, said: 'For too long, the Chinese government has tried to exploit US government employees behind the cover of fake companies and phoney job postings. Today, we shut them down.'

Aftermath and Denials

Following the seizures, the FBI replaced all 13 websites with warning notices confirming the domains had been disabled as part of a law enforcement operation. The Justice Department noted that the suspects have denied any involvement by a foreign government. The broader scheme allegedly also helped move money from outside the United States into the country in furtherance of the recruitment operation, according to federal prosecutors.

This operation comes amid sustained US government concern over Chinese intelligence targeting of cleared personnel — a pattern that authorities say has intensified with the adoption of AI tools to fabricate credible-looking front organisations. Whether further arrests follow the domain seizures remains to be seen.