“These actors use an aggressive online recruitment strategy whereby intelligence officers or their affiliates pose as employees of private consultancies, think tanks, or human resources firms, and place online job advertisements for foreign policy and defence analysts (or similar),” the UK domestic counter‑intelligence service MI5 warned in a fresh advisory published Wednesday evening.
MI5’s core warning: China seeking privileged military, political and economic intelligence
MI5’s advisory says Chinese military intelligence is actively recruiting people with access to classified or privileged information via popular job and gig platforms such as LinkedIn, Indeed, and Upwork. The agency says the purpose is explicit: to “acquire privileged military, political, and economic intelligence that can provide China with a strategic and tactical advantage over the Five Eyes.”
The notice cautions that the campaign is not limited to traditional defence contractors: security‑clearance holders, defence and foreign affairs staff, military personnel, and those with indirect government access — academics, journalists, think tank employees and others — are being targeted. MI5 closes the advisory with a blunt reminder of consequences: “Certain types of data can place the lives of frontline military or other personnel at risk, can weaken our economic prosperity, and enable interference in our democratic processes,” and it warns that unauthorized disclosure “could face a number of consequences, including prosecution under national laws such as those relating to espionage.”
Target profiles and the questions recruits face
According to MI5, Chinese military intelligence officers are prioritising individuals most likely to possess valuable information. The agency says recruiters probe for access: targets are asked who they know in government; military personnel may be questioned about where they were based and what tasks they performed. The advisory stresses that even the act of submitting a résumé — which contains personal details — exposes candidates to privacy and security risks.
Tradecraft: job ads, résumé ranking, trial reports and encrypted messaging
MI5 describes a consistent pattern in the outreach: operatives or their affiliates post online job adverts posing as consultancies, think tanks, or HR firms, openly advertising roles such as foreign policy and defence analysts. Responses are scored — résumés are ranked “based on how likely a given individual is to have information of interest” — followed by interviews. Successful applicants are frequently asked to complete trial reports on China‑related topics. Conversations then often move to encrypted messaging platforms, where recruits are offered payment in exchange for increasingly sensitive material.
Payments and platforms: mainstream services and illicit channels
The advisory notes a range of payment mechanisms used by recruiters. MI5 lists reputable online services — PayPal, Zelle and Wise — alongside methods “more commonly associated with illegality,” such as Western Union and cryptocurrencies. That mix, the agency implies, helps mask the origin and purpose of payments while making it easier to entice targets with rapid compensation.
Past advisories and international echoes: 2021 warnings, parliamentary briefings and FDD reporting
MI5’s latest advisory sits atop an established pattern of warnings. In 2021 the agency said roughly 10,000 Britons had been targeted by Chinese spies over the previous five years using workplace platforms, a figure MI5 described as conservative; the agency head Ken McCallum said those platforms were being exploited “on an industrial scale.”
More recently, in November, the UK security minister Dan Jarvis reminded members of the House of Commons that they should have received MI5 information about attempts to recruit parliamentarians via similar online methods; MI5 also distributed the names of two online profiles suspected of involvement in recruitment campaigns. Across the Atlantic, MI5’s bulletin notes, “the US said it was seeing similar tactics used when President Trump took office for the second time, which shortly after led to mass redundancies across federal agencies.” Analysts at the Foundation for Defense of Democracies named five alleged consulting companies that targeted recently laid‑off workers on platforms including LinkedIn and Craigslist, offering positions that could be used to extract state secrets. FDD senior analyst Max Lesser told The Register that layoffs beginning in February 2025 “would have likely raised the risk level associated with state secrets being spilled.”
What this means for military personnel, parliamentarians, and academics
- Military personnel: Expect direct questions about postings and duties; MI5 warns that such answers may be used to evaluate access to sensitive information and to pressure recruits for classified material.
- Parliamentarians and political staff: MI5 has previously supplied MPs with suspect online profiles and briefings; those in or near government should treat unsolicited recruitment approaches through professional networks as a potential threat.
- Academics, journalists and think‑tank staff: Even indirect access to government information places individuals on recruiters’ shortlists; MI5 flags the risk that trial reports and initial consultancy work will be used as a pathway to solicit non‑public material.
MI5’s advisory is a clear, granular map of a campaign that mixes commonplace recruitment practices with targeted intelligence collection. Its blunt closing — that some disclosures could endanger lives and lead to prosecution — frames this as a security problem with legal and moral stakes. The agency’s repeated warnings, reinforced by similar observations abroad and by think‑tank reporting tied to post‑February 2025 layoffs, leave a practical question: will institutions that hold cleared or privileged information tighten hiring and outreach protocols quickly enough to blunt a repeat of the last wave?
