ZeroFox Intelligence Brief - Fake Geopolitical Consultancy Jobs: China’s Espionage Tactic

ZeroFox Intelligence Brief - Fake Geopolitical Consultancy Jobs: China’s Espionage Tactic

Product Serial: B-2025-07-21a

TLP:CLEAR

In this Intelligence Brief, ZeroFox researchers report on the link between state espionage campaigns and malicious fabricated job advertisements.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

• State-sponsored actors are exploiting online job platforms such as LinkedIn and Indeed to recruit candidates with security clearances and other insiders for intelligence-gathering under the guise of remote consultancy work.
• ZeroFox observed a likely espionage campaign in India using online job platforms to recruit individuals with privileged access to the Indian government’s diplomatic activities. The entity used social engineering and phishing tactics to recruit citizens as unwitting informants for the operation.
• Cybersecurity researchers suggest that the IP addresses and domain used in the India campaign likely belong to an advanced persistent threat (APT).
• Similar espionage campaigns have been reported in the United States and Europe. Multiple intelligence agencies, including that of the United States and the United Kingdom, have linked such campaigns to Chinese intelligence operations.