The consulting firms offering US government workers easy money were fake, top to bottom. Fake company names, fake staff, and fake faces, some of them generated by AI. None of the 13 companies were real, and the FBI says suspected Chinese agents built every one of them to pull secrets out of Americans with security clearances.
On June 10, 2026, the FBI and the Justice Department seized 13 websites that posed as consulting companies. Each one advertised vague, well-paid work and quietly tried to recruit current and former government and military staff into handing over sensitive information. The sites are dead now. Visit any of them and you hit an FBI takeover page saying the domain was disabled.
Justice Department domain seizure announcement
How the trap worked
Starting in November 2023, the operators stood up at least 13 fake consulting companies with names like Centrik Global Consulting, Pulse Wave Global, and GeoIndopacific. They posted jobs on real hiring sites, including Upwork, Wellfound, Hubstaff Talent, Expertia AI, and Post Job Free. Job titles sounded normal, things like "Senior Analyst" and "International Affairs Consultant."
Then came the money. The FBI says recruiters offered big payments for short reports. Then they pushed targets to share "exclusive" or "insider" information they had a duty to protect. Payments ran through crypto and overseas accounts under fake names. The operators used Telegram and other encrypted apps, not normal work email.
Everything looked legit on purpose. There were contracts, confidentiality agreements, staff photos, and glowing testimonials. One site got sloppy and faked its customer reviews using characters from the movie Anchorman, quoting Ron Burgundy and Brick Tamland as happy clients.
FBI list of seized domains and methods, Anchorman fake-testimonial detail
Why the timing matters
Reporting on the case connects it to the wave of US federal layoffs over the past year, which pushed thousands of government workers, including cleared ones, into the job market. The seizure announcement itself does not blame the layoffs. But a freshly unemployed person hunting for income is an easier mark than someone settled in a secure post.
An NCIS memo flagged that foreign operatives were going after people who marked themselves "open to work" on professional sites. Recruiters chased specific subjects too. According to that reporting, they wanted insider takes on US-China relations, Iran, and the Israel-Palestine conflict, and the fake jobs leaned toward foreign policy and defense work.
NCIS warning on "open to work" targeting, Federal layoffs and clearance holders
An old trick, new faces
China-linked operatives have pulled the fake-consulting move before. The new ingredient is the AI. In 2020, a man named Jun Wei "Dickson" Yeo pleaded guilty to running a sham firm called Resolute Consulting and using LinkedIn to find targets. He collected more than 400 resumes, about 90% from Americans with security clearances, and paid officials for reports that went to China.
Two years before that, ex-CIA officer Kevin Mallory got a LinkedIn message from a Chinese officer posing as a think tank recruiter. Mallory, who was deep in debt, handed over classified documents and got 20 years. Western agencies have shouted about this pattern for ages. Germany said in 2017 that China had used fake LinkedIn profiles to reach more than 10,000 Germans, and Britain's MI5 later put the number of approached UK nationals at over 10,000 too.
What changed is the cost of looking real. An AI photo of a person who does not exist is free and takes seconds to make. Security researchers at Palo Alto Networks showed how cheap this can get. In about 70 minutes, a low-skill operator could make a live deepfake face for a job interview using free tools and a cheap graphics card.
And people are bad at catching it. One study found humans land close to coin-flip odds when judging AI-generated faces, and synthetic faces were the hardest of all to call. That gap helps explain why fake faces are useful in a recruiting scheme like this one. Cheap, convincing, good enough to fool a busy person reading email.
Dickson Yeo Resolute Consulting case, Kevin Mallory LinkedIn recruitment, Study on spotting AI-generated media
How to spot the bait
You don't need a counterintelligence background to catch one of these. The FBI and the National Counterintelligence and Security Center published plain guidance on exactly this kind of approach. Watch for these:
- A vague "consulting" or "analyst" role that pays a lot for a short report.
- Any request for inside, exclusive, or non-public information, or pressure to break an NDA.
- A recruiter whose photo or profile looks thin or brand new. Run the headshot through a reverse image search.
- Payment in crypto or through odd overseas accounts instead of normal payroll.
- A quick push to move the chat onto Telegram or another encrypted app.
If an offer like that lands in your inbox, the right move is to not engage and not send anything. Report it at tips.fbi.gov or call 1-800-CALL-FBI, and if you hold a clearance, tell your security officer too.
China's embassy called the whole case "entirely fabricated" and "malicious slander," and the people behind the sites denied working for any government. But frankly, the playbook here is nothing new, just cheaper to run than ever. Assume the too-good consulting gig from a stranger is a trap until you can prove it isn't.
