FBI Reveals China's Exploitation of Trump's Federal Layoffs to Recruit Newly Unemployed Government Workers as Spies

The FBI has seized 13 fake consulting websites allegedly run by Chinese intelligence operatives to recruit unemployed US government workers as spies.

Federal authorities announced on 10 June 2026 the takedown of 13 internet domains used to post fraudulent job postings targeting current and former US officials with security clearances. The scheme, which allegedly began in November 2023, accelerated its reach as the Trump administration's mass federal layoffs left tens of thousands of cleared government workers actively seeking new employment.

According to court documents filed in support of the seizure warrants, the conspirators posed as legitimate consulting firms while pressuring recruits to hand over confidential and potentially classified information in exchange for payment.

Fake Firms, Stolen Identities and AI-Generated Faces

The 13 seized domains operated under names designed to convey credibility: Centrik Global Consulting, Catalyst Global Solutions, GeoIndopacific, SafeSec Group and Gulf Peace Foundation, among others. According to the DOJ affidavit, the conspirators constructed the sites using stolen identities, fabricated personas and AI-generated photographs to manufacture the appearance of real organisations.

Job listings on platforms including LinkedIn, Upwork, Expertia AI and Wellfound advertised vague roles such as 'Senior Analyst,' 'International Affairs Consultant' and 'Jobs for Ex-Military Personnel.' Once applicants were engaged, recruiters allegedly pressured them to provide 'exclusive' or 'insider' information and to submit reports on subjects of direct interest to Beijing, including China-US relations, Iran, and the Israel-Palestine conflict.

One of the websites went so far as to include testimonials attributed to fictional characters from the comedy film Anchorman, including Will Ferrell's Ron Burgundy and Steve Carell's Brick Tamland. Contracts and confidentiality agreements were used throughout to lend the operations a veneer of corporate legitimacy.

Payments were routed through cryptocurrency and overseas bank accounts to obscure the true source of the funds. The DOJ stated that the conspirators 'used online payment accounts in the names of fictitious individuals' and facilitated the transfer of money from foreign accounts into the United States.

DOGE Layoffs Created the Recruitment Window Beijing Exploited

The timing of the FBI operation is inseparable from the Trump administration's sweeping programme of federal job cuts. The Department of Government Efficiency (DOGE), led by Elon Musk, has pushed through the termination of hundreds of thousands of federal employees since early 2025, with targets concentrated inside agencies that handle sensitive national security, defence and foreign policy work.

Intelligence agencies flagged the risk early. A Naval Criminal Investigative Service (NCIS) document reviewed by CNN noted that foreign intelligence operatives had been instructed to seek out federal employees who publicly signal they are 'open to work' on LinkedIn, TikTok, RedNote and Reddit. The NCIS assessed it was 'highly likely' that Washington's adversaries were attempting to capitalise on the DOGE-driven dismantling of the federal workforce.

The National Counterintelligence and Security Centre (NCSC) had separately warned in April 2025 that Chinese intelligence was posing as 'consulting firms, corporate headhunters, think tanks, and other entities on social and professional networking sites,' with deceptive tactics growing 'more sophisticated.' The centre urged former federal employees to treat unsolicited outreach from unknown contacts with extreme caution.

FBI and DOJ Officials Speak Directly to the Threat

The seizures drew pointed public statements from multiple senior law enforcement figures. 'For too long, the Chinese government has tried to exploit US government employees behind the cover of fake companies and phony job postings,' said Special Agent in Charge Daniel Wierzbicki of the FBI's Washington Field Office Counterintelligence and Cyber Division. 'Today, we shut them down.'

Assistant Attorney General for National Security John A. Eisenberg focused on the financial lure used to ensnare recruits. 'These domain seizures offer a glimpse at how foreign actors can use promises of easy money to lure Americans into revealing sensitive or classified information that they are duty-bound to protect,' he said in a statement. 'Anyone approached online with offers of easy income for vague 'consulting' work should treat those overtures with extreme caution.'

FBI Counterintelligence and Espionage Division Assistant Director Roman Rozhavsky pointed specifically to the role of artificial intelligence in the scheme. 'The fake consulting company domains seized by the FBI illustrate the lengths the Chinese government's intelligence services will go to as they try to use AI-generated content to trick, recruit, or coerce current and former US security clearance holders,' he said. The FBI placed takeover pages on all 13 seized domains following the operation, warning visitors that the sites had been rendered inoperable.

Leads came from the targets themselves. 'A lot of this information came from doing interviews, interviews with people who came forward that something didn't seem right,' Wierzbicki told the Associated Press.

A Coordinated Western Response to a Persistent Threat

The DOJ seizure sits within a broader intelligence-sharing effort. The Five Eyes alliance, comprising Australia, Canada, New Zealand, the United Kingdom and the United States, had issued a joint warning on similar Chinese recruitment tactics just one week prior. The coordinated timing suggests Western governments are attempting to move from reactive exposure to active disruption.

China's foreign ministry denied knowledge of the operation, with a spokesman accusing the United States of espionage against China, according to Reuters. No charges have been filed against named individuals, and it remains unclear whether any of the seven unnamed recruits identified in the FBI affidavit will face prosecution.

For cleared professionals who lost jobs under DOGE and now find themselves on the receiving end of lucrative-sounding online consulting offers, the FBI's message is blunt: the money is real, the company is not, and the consequences could be severe.

With mass federal layoffs producing an unprecedented pool of security-cleared workers in active job searches, US counterintelligence officials are warning that the exploitation window remains wide open.