Counterintelligence — 2026-08-18

FBI-Led Five Eyes Investigation Seizes 13 Fake Websites Used to Recruit Western Spies for China

BLUFChina's exploitation of gig-economy platforms for human intelligence recruitment has matured into a scalable, alliance-wide threat that freelance job boards lack the screening architecture to detect.

The FBI, coordinating with counterintelligence agencies in Australia, Canada, the United Kingdom and New Zealand, seized 13 websites tied to a suspected Chinese intelligence recruitment operation, the Justice Department said in a press release 1. The sites, including "Centrik Global Consulting," "Pulse Wave Global," "Rightinfo Consulting" and "Catalyst Global Solutions," posted fake analyst and consultant job listings on platforms such as Upwork, Wellfound, Hubstaff Talent, Expertia AI and Post Job Free to target current and former U.S. government and military personnel holding security clearances, using fictitious personas, stolen identities and AI-generated photographs 1. According to the DOJ affidavit, the operation ran since at least November 2023, with recruiters moving contacts to Telegram and paying between a few hundred and several thousand dollars per "research report" containing sensitive information via cryptocurrency and services including PayPal, Payoneer, Zelle, Skrill, Wise and Western Union 1. The website operators face allegations of conspiracy to commit bribery, identity theft and international money laundering, and the seizures followed a joint Five Eyes alert issued one week earlier warning of similar recruitment schemes 1.

Analysis
The seizures point to a durable Chinese intelligence tradecraft model built on gig-economy platforms rather than a one-off scheme, using AI-generated personas and stolen identities to bypass vetting on Upwork, Wellfound and Hubstaff Talent in ways that create a replicable template for other services. Reporting rests on a single primary source, the Justice Department's press release, with secondary outlets amplifying rather than independently corroborating the account. Coordination across all Five Eyes agencies signals the operation targeted the allied cleared workforce broadly, not only US personnel, raising the stakes for allied vetting protocols and insider-threat training. The public seizure announcement may function primarily as a deterrence signal rather than a full network disruption, since the core operators remain unidentified and unindicted, meaning clearance holders and employers should treat freelance consulting solicitations as a standing rather than resolved threat.

3 sources

FBI shuts down 13 'consulting' websites used for suspected Chinese espionage - SC Media
Probe uncovers network of fake websites enticing Westerners to spy for China - IntelNews
Justice Department, FBI Disable 13 Websites Backed by Suspected Chinese Agents That Sought Sensitive U.S. Information from Security Clearance Holders - U.S. Department of Justice, Office of Public Affairs