The Five Eyes' 'Safeguarding Our Secrets' Alert: How China Targets You on LinkedIn

Who is on China's target list?

China's spy recruiters are not casting a random net. The bulletin defines three high-priority targets, ranging from obvious insiders to people who might be unaware they hold valuable information .

• Security clearance holders are the primary target, especially those in defense, foreign affairs, and intelligence roles .
• Military members are actively stalked on these platforms, particularly personnel stationed in the strategically vital Indo-Pacific region. Recruiters seek granular details about their roles, unit activities, and even the location of their home base or naval vessel .
• Indirect access holders are a crucial and potentially less guarded category. The bulletin warns that academics, journalists, think tank analysts, and freelance writers are also of intense interest because their work often touches on defense, security, and economic policy. The agencies warn that seemingly innocuous, unclassified information from these sources can be combined with more sensitive data to form a complete operational picture .

Decoding the five-phase recruitment playbook

The bulletin pulls back the curtain on a meticulous, step-by-step strategy that intelligence officers use to turn a casual job seeker into a paid informant .

Phase 1: The Bait — It all starts with a job posting. Recruiters posing as HR professionals for fake but legitimate-looking "cover companies" place ads on professional networking sites, online hiring boards, and freelance platforms. Resumes submitted are screened for one thing: evidence of current or future access to sensitive information .

Phase 2: The Trial Assignment — A candidate who looks promising is not offered a job but a freelance test. They are paid to write a trial report on a seemingly legitimate topic, such as bilateral relations with China, Indo-Pacific defense issues, or international trade policy. This tests the candidate's access to information and willingness to write about sensitive subjects .

Phase 3: The Virtual Interview — Those who deliver useful reports are invited to an online interview. The recruiter's true identity remains hidden, often claiming to represent a consultancy in a neutral country. The tone shifts to an aggressive probe of the target's personal and professional contacts, with military personnel being asked point-blank about ship deployments or unit capabilities .

Phase 4: The Ask and the Move — The relationship escalates sharply. The recruit is told their "client" now needs more privileged, non-public information. Conversations are typically moved from the initial professional platform to more secure, encrypted messaging applications to evade detection .

Phase 5: Covert Payment — A financial incentive seals the bargain. Recruits receive payments ranging from a few hundred to several thousand dollars per report, with higher sums offered for increasingly sensitive intelligence. Payments are laundered through a wide array of digital services including PayPal, Payoneer, Zelle, Skrill, Wise, Western Union, e-transfer, or cryptocurrency, often originating from an account belonging to a person the recruit has never met .

How this unprecedented warning escalates a pattern of alerts

The "Safeguarding Our Secrets" bulletin does not exist in a vacuum. It represents the culmination of years of growing concern. Western intelligence agencies had previously issued isolated, country-specific warnings. For instance, MI5 had warned UK government staff, and Canada's CSIS had alerted its own citizens to similar threats . However, this 2026 bulletin forges a unified front.

The document's significance lies in its operational detail. It goes far beyond general warnings of "be careful online" to name the platforms being exploited—with LinkedIn frequently cited by name in corroborating reports—and lays out the entire recruitment life cycle. It also provides specific guidance on how to report suspicious activity through corporate security and national tip lines .

Beijing has consistently refuted these allegations, calling them "pure fabrication and malicious slander" . Yet the decision by all five allied intelligence agencies to expose a covert recruitment program with this level of precision signals a deliberate strategy to inoculate their workforces against a threat they see as persistent and evolving.