Federal authorities shut down 13 internet domains allegedly operated by fake consulting firms targeting U.S. government and military employees to gather intelligence for Chinese agents.
The FBI announced the domain seizures on Wednesday as part of an ongoing operation to disrupt foreign espionage efforts. According to the U.S. Justice Department, the fake consulting firms posed as legitimate recruitment and staffing agencies to solicit sensitive information from federal employees and military personnel.
The seized domains were used to create phishing websites and conduct social engineering attacks designed to compromise government workers. Investigators determined the operation was connected to agents working on behalf of the Chinese government, though specific details about the intelligence targets remain limited.
This action reflects growing concerns among U.S. officials about foreign intelligence operations targeting American government and defense sectors. Chinese government-linked groups have increasingly relied on digital deception tactics—including fake job postings, business fronts, and recruitment scams—to identify and compromise federal employees with access to classified information.
The FBI advises government workers to exercise caution when contacted by unfamiliar recruitment firms, particularly those offering unusually attractive positions or requesting detailed background information. Employees are encouraged to verify any job opportunities through official channels and report suspicious solicitations to their agency's security office.
The domain seizure is part of a broader federal initiative to combat foreign influence operations and protect national security. Similar operations have targeted Iranian and Russian intelligence activities in recent years, though operations attributed to Chinese entities have increased in frequency and sophistication.
The Justice Department did not release the specific domain names or provide additional details about the scope of the intelligence-gathering operation. An investigation into the full extent of the scheme remains ongoing.
Cyberattacks against hedge funds and private equity firms have been attributed to UNC6671, an extortion group connected to the BlackFile threat actors. The campaign represents an escalating threat to the financial sector.
A Go-based malware distributed through ClickFix attacks is targeting macOS users to steal cryptocurrency, passwords, and Apple Keychain data. The infostealer campaign combines social engineering with credential harvesting.
A former NSA official has warned against connecting water infrastructure controllers to the internet following suspected Iranian cyberattacks on U.S. water systems.
Security researchers scanning Polish government websites discovered critical vulnerabilities that could expose courts, hospitals, and airports to cyberattacks. The vulnerabilities stem from common software used to manage and display web content.