The United States and its main intelligence allies report that China's military intelligence units are turning to online job boards and networking platforms to draw in foreigners holding access to sensitive data.

A bulletin issued this week by the Five Eyes alliance cautioned that Chinese intelligence officers pose as recruiters on LinkedIn and similar sites. Their targets include government and military staff plus journalists and academics who may hold classified or privileged material. The Five Eyes group comprises security agencies from the United States, Britain, Canada, Australia and New Zealand.

These officers develop ties with candidates and sometimes propose payment for reports on subjects of interest to Beijing such as defense and trade, the bulletin noted. Their aim is to obtain privileged military, political and economic intelligence that could give China a strategic edge over the Five Eyes nations.

The alert aligns with recent encounters by International Consortium of Investigative Journalists reporters who received approaches from apparent recruiters. Following the release of the China Targets probe into Beijing transnational repression efforts, several journalists began getting suspicious messages via LinkedIn and email.

Two separate consulting outfits reached out to offer collaboration.

One invitation arrived from a Singapore-registered firm that claimed to provide risk assessment services. The sender, using the name William Harrison, proposed paying 300 dollars for analytical articles along with bonuses tied to quality. Harrison avoided naming specific topics. When the exchange shifted to WhatsApp the contact showed a Hong Kong number and a different Chinese name.

ICIJ also received a message from a New York based entity seeking input on China's actions against the Uyghur population in Xinjiang. The sender, identifying as Gregory Thompson, stated the work supported research on upcoming Chinese policies. In a later WhatsApp note Thompson indicated the firm was preparing an analysis of Chinese transnational repression for a client.

Thompson then shared a document link requesting professional insights on key sections. The file carried the title The Extended Shadow Inside Beijing Global Network of Transnational Repression.

The link resembled others previously used by Chinese state linked actors impersonating ICIJ staff to obtain data from activists and Taiwanese officials.

These digital intrusions were traced by ICIJ and Citizen Lab to a Beijing backed operation aimed at journalists covering repression of overseas dissidents.

Citizen Lab examined the suspicious messages sent to ICIJ reporters and similar notes from impersonators directed at targets across Asia, Europe and the United States. The campaign sought information from groups of interest to the Chinese government including Uyghur, Tibetan, Taiwanese and Hong Kong diaspora activists along with journalists reporting on those communities.

A spokesperson for the Chinese Embassy in Washington stated that China opposes all forms of cyber attacks.

The threat is real

The recent Five Eyes bulletin titled Safeguarding our Secrets tied the cover companies to Chinese military intelligence and labeled them a threat.

Applicants beware the FBI posted on social media. The threat is real.

The firms present themselves as consulting groups or think tanks with plausible websites and claim bases outside China. Recruiters contact targets, arrange interviews and request written reports on varied subjects before shifting talks to supposedly secure platforms. Payment offers can reach hundreds or thousands of dollars via third party services or cryptocurrency.

Last year the Foundation for Defense of Democracies identified numerous domains connected to such consultancy operations.

The agencies warned that targets may be led to disclose personal details or intelligence that could put lives at risk.

Certain data can endanger frontline personnel, harm economic strength and allow interference in democratic systems.