Justice Department and FBI Seize 13 Web Domains They Say Chinese Agents Used to Recruit U.S. Clearance Holders
Federal prosecutors obtained court warrants to take down fake consulting sites; no one has been publicly charged, and China's government rejects the accusation.
The Job Ad Was Real. The Company Wasn't.
Thirteen websites went dark on June 10, 2026. Visitors who typed in the old addresses got a federal notice instead: seized as part of a criminal investigation into bribery, identity theft and money laundering[8]. The Justice Department and the FBI say the sites were fronts, built to look like ordinary consulting firms, and aimed at one specific group — Americans who hold, or once held, a U.S. security clearance[1].
Here is the tension at the center of this story. The government says the operation was "backed by suspected Chinese agents." That is the entire headline. But nobody has been charged[1][3]. A seizure warrant is not a conviction — it is a judge's order letting agents take control of property while an investigation continues, based on probable cause, a far lower bar than the proof needed to convict anyone[1]. So what the public has is a detailed, sworn account of how a scheme worked, and no defendant to test that account in court.
How You Build a Fake Employer
According to the FBI affidavit, the operation started in November 2023[1]. It ran for roughly two and a half years before anyone shut it down[1][4].
The method was patient. Recruiters posted ordinary-sounding jobs — "senior analyst," "international affairs consultant" — on real hiring platforms people actually use: Upwork, Wellfound, Hubstaff Talent, Expertia AI and Post Job Free[1][4][5]. The recruiters themselves used aliases, some built on stolen identities, with AI-generated headshots standing in for real staff photos[1][4].
Once someone applied and started talking, the pitch shifted. The affidavit says recruiters pushed applicants toward encrypted messaging apps and asked for insider reports[1]. Payment came through accounts opened under false names, money moved from overseas into the U.S., and cryptocurrency helped obscure where it all came from[1][4]. FBI Assistant Director Roman Rozhavsky said the pattern shows foreign intelligence services using AI-generated content to "trick, recruit, or coerce" people who hold clearances[1][8].
The cost math here matters. A domain costs a few dollars a year. AI tools now generate a passable headshot or company bio for free. Whoever ran this can rebuild the same setup somewhere else almost as fast as it took investigators to find this one[1][4].
Why a Takedown Happens Before an Indictment
If the people running these sites are outside U.S. jurisdiction, an indictment does not get anyone arrested. It just becomes a name on paper. A seizure warrant, by contrast, produces something immediate: the sites go dark today[1][2].
That is the trade the Justice Department is making, and it is worth naming plainly rather than reading as either purely protective or purely theatrical. Counterintelligence work is judged on losses prevented, which are nearly impossible to show to the public. A seizure is visible, provable output — and it doubles as a warning to the next clearance holder who gets a flattering unsolicited job offer[1]. U.S. Attorney Jeanine Ferris Pirro said anyone trying to exploit clearance holders "will be exposed and dismantled"[1][8].
The flip side of that trade is exposure. A seizure with no eventual prosecution leaves the underlying claim — that this was Chinese state activity — permanently untested in court[1][3]. The FBI is betting that disruption now is worth more than the risk of an unproven allegation sitting in the public record indefinitely.
Two Countries, Two Flatly Different Stories
China's government does not dispute that 13 websites went offline. It disputes everything else. Foreign Ministry spokesperson Lin Jian called the "Chinese spy" narrative "totally baseless"[7]. A Global Times editorial ran under the headline "thief crying stop thief," arguing the United States is itself the world's largest surveillance operator[7][10].
Notice what that response does and doesn't do. It never addresses the 13 named domains, the November 2023 start date, or the payment details in the affidavit[1][7][10]. It answers a specific, evidentiary U.S. claim with a general counter-accusation. That is also, roughly, Beijing's standard reply to nearly every foreign espionage allegation — which cuts both ways: the consistency makes this specific denial carry less new information, but it also means the U.S. is asking the world to accept an unproven allegation from a press release as fact, something Beijing's defenders argue should trouble anyone regardless of how they feel about China[1][3][7].
South China Morning Post, a Hong Kong outlet, split the difference in its coverage — reporting the seizure straight, keeping "suspected" throughout, and noting plainly that no charges have been filed[3].
The Part of the Story the Government Didn't Tell
There is a second dispute running underneath the U.S.-China one, and it is domestic. Center-left U.S. outlets, including the Washington Post, connect this recruiting wave to a specific vulnerability: large federal workforce cuts left thousands of cleared employees job hunting at once[5]. Earlier reporting has described Russian and Chinese services actively courting workers laid off in DOGE-era federal reductions[9].
That is not a claim the Justice Department made. Its release describes the scheme and its methods but says nothing about the size or origin of the pool of people it targeted[1]. The causal link between the layoffs and this specific recruiting campaign is something reporters added, not something DOJ asserted[1][5][9].
It is, structurally, a real vulnerability either way. A large clearance-holding workforce entering the job market at once is an easy population to reach — a recruiter does not need to break into anything. They just need to post a listing on a platform that does not verify whether an employer actually exists[5][9].
What Every Version of This Story Skips
Lay the coverage side by side and a pattern shows up fast. The Washington Times headline says the FBI "shutters covert Chinese websites targeting secrets" — no "suspected," no "alleged," secrets recast from job-posting bait into something closer to classified material[8]. RedState calls it a "devastating new blow to Chinese Intel Operations," a verdict on effectiveness that nothing in the record actually supports, since re-registering 13 domains costs almost nothing[6]. Global Times, on the other side, never engages the specific evidence at all[7][10]. DOJ's own release uses the hedge "suspected" but pairs it with the verb "disable," which reads to most readers as a finished, settled case[1].
The throughline across all of it is the same fact, moving at different speeds toward the exit. Four different audiences — U.S. right, U.S. left, Chinese state media, and DOJ's own press office — each emphasize a different piece of this story. But none of them lead with the plainest fact available: as of this writing, nobody has been publicly charged with anything[1][3]. The websites are gone. The people who built them are not named, and the case that they worked for Beijing has been made once, in a sworn affidavit, and not yet tested anywhere else.
Summary
On June 10, 2026, the Justice Department and the FBI said they had seized 13 internet domains[1][2]. The government says the sites posed as consulting firms and hunted for Americans who hold, or once held, U.S. security clearances. Visitors now see a federal seizure notice instead of a website[8].
A seizure warrant is not a conviction. It is a court order letting the government take control of property — here, web domains — while an investigation continues. A judge signs it after reviewing a sworn FBI affidavit. The standard is probable cause, which is far below the proof needed to convict someone. That distinction matters here, because the Justice Department has not publicly charged anyone in this case[1].
According to the FBI affidavit, the network started in November 2023[1]. Fake firms posted generic jobs — 'senior analyst,' 'international affairs consultant' — on real hiring platforms. Recruiters used made-up names, stolen identities and AI-generated profile photos. Once someone applied, the affidavit says, recruiters pushed for insider reports and offered money, moved overseas funds into the U.S., and used cryptocurrency to hide where the payments came from[1][4].
The main dispute is not really about whether the sites existed. It is about who ran them. The U.S. calls them 'backed by suspected Chinese agents'[1]. China's Foreign Ministry says the spy narrative is 'totally baseless,' and Chinese state media accuses Washington of projecting its own surveillance record onto Beijing[7][10]. A second, quieter dispute is domestic: some U.S. reporting ties the recruiting pitch to the large federal workforce cuts that left cleared employees looking for work[5][9]. The Justice Department made no such claim.
The Event
On June 10, 2026, the Justice Department and the FBI announced the seizure of 13 internet domains under warrants issued in the U.S. District Court for the District of Columbia[1][2]. The government said the domains hosted fake consulting-company websites that advertised jobs to current and former U.S. government and military personnel with security clearances[1]. The seized sites now display a federal notice saying they were taken as part of an active criminal investigation involving bribery, identity theft and international money laundering[8]. No defendants were named publicly in the announcement[1][3].
Undisputed Facts
- The U.S. government took control of 13 internet domains on or before June 10, 2026, under court-issued seizure warrants[1][2].
- The seized domains now show a federal seizure notice rather than their original content[8].
- The FBI affidavit states the network of fake consulting websites began in November 2023[1].
- The advertised roles included titles such as 'consultant,' 'senior analyst' and 'international affairs consultant,' aimed at people with U.S. government or military backgrounds[1][4].
- The Justice Department says recruiters used aliases, stolen identities, AI-generated profile photos, encrypted messaging apps and payment accounts opened under fake names[1][4].
- Job postings appeared on commercial hiring and freelance platforms including Upwork, Wellfound, Hubstaff Talent, Expertia AI and Post Job Free[5].
- U.S. Attorney for the District of Columbia Jeanine Ferris Pirro and FBI Counterintelligence Division Assistant Director Roman Rozhavsky both issued public statements about the seizure[1][8].
- The Justice Department's own announcement uses the word 'suspected' for the Chinese link and names no charged defendant[1].
- China's Foreign Ministry spokesperson Lin Jian publicly rejected the U.S. allegation, calling the 'Chinese spy' narrative 'totally baseless'[7].
The Pressure
Strip away the moralizing and blame. What structural realities persist regardless of which narrative wins?
- Disruption beats prosecution when suspects are unreachable
- If the operators sit outside U.S. jurisdiction, an indictment produces no arrest. A seizure warrant produces an immediate, visible result. So U.S. agencies increasingly choose takedowns, and the public gets accusations that are never tested by a defense in court[1][2].
- A shrunken federal workforce is a recruiting pool
- Large layoffs put thousands of people with clearances and institutional knowledge into the job market at once. Foreign services do not need to break into anything to reach them — they only need to post a job[5][9].
- Cheap infrastructure, expensive defense
- A domain costs a few dollars a year. AI tools now generate convincing staff photos and company copy for almost nothing. The attacker's cost of rebuilding after a takedown is trivial; the government's cost of finding and seizing the next batch is not[1][4].
- Denial is a standing policy, not a case-specific reply
- Beijing rejects essentially every foreign espionage allegation in near-identical language. That consistency means a denial carries little information either way about this specific set of domains[7][10].
Material realityThirteen domains are offline and now show federal seizure notices[8]. The underlying method is not offline. Registering new domains, generating new faces and posting new listings costs very little, and the affidavit describes a network that ran for roughly two and a half years before anyone took it down[1]. No one has been publicly charged, so the state-sponsorship claim remains an FBI assertion supported by a sworn affidavit rather than a finding proved in court[1][3]. Meanwhile the target population is real and large: cleared and formerly cleared Americans looking for work, reachable through ordinary commercial job platforms that do not verify whether an employer exists[5][9].
Narrative as a weaponThree parties are shaping how this reads. The Justice Department wants you to see a functioning counterintelligence system that catches an adversary in the act — it leads with the AI detail because that is what makes the threat feel current, and it lets 'suspected' do quiet legal work while the headline reads as settled. Right-leaning U.S. outlets want you to see confirmation that China is actively working inside the country, and they drop the hedges to get there; RedState goes further and scores it as a decisive win. Chinese state media wants you to see an evidence-free political announcement in a long series of them, so it answers with a counter-accusation about U.S. spying rather than with any response to the 13 named domains. Left-leaning coverage largely accepts the facts but adds a frame the government did not offer: that mass federal layoffs helped create the vulnerable population being recruited. The one fact all four sides walk past at different speeds is the simplest — as of this writing, no defendant has been publicly charged.
How Each Side Sees It
Each major actor’s view — how it frames things, its underlying incentive, and how it’s materially affected. Tap a side to read it.
Frames it asTheir case rests on disruption, not punishment. Waiting for an indictment against people who sit outside U.S. reach would mean letting the sites keep running for years. Seizing the domains stops the harm now. Officials also argue the method is the real story: Rozhavsky said the sites show foreign intelligence services using AI-generated content to 'trick, recruit, or coerce' clearance holders[1][8]. Pirro's argument is one of deterrence and duty — people trusted with the nation's secrets are being hunted, and the government must show that such efforts get found and taken apart[2]. The public notice on each seized domain is itself part of the point: it warns the next person who gets a flattering job offer.
WhyCounterintelligence agencies are judged on prevented losses, which are hard to show. A visible takedown is provable output. It also serves as a public awareness campaign aimed at the cleared workforce, which no indictment could deliver as fast[1].
Impact on themThe FBI gains investigative material — payment records, applicant lists, platform accounts — that can support later charges. It also absorbs the risk of criticism if no prosecution ever follows, since a seizure with no defendant leaves the underlying claim untested in court[1][3].
Frames it asBeijing's strongest argument is about the standard of proof, not about denial alone. The U.S. asserted a state link in a press release, using the word 'suspected,' without producing a defendant, an indictment or evidence the public can examine[1]. Foreign Ministry spokesperson Lin Jian said the 'Chinese spy' narrative is 'totally baseless' and argued the country most engaged in worldwide espionage is the United States itself[7]. A Global Times editorial pressed the same point under the phrase 'thief crying stop thief' — a Chinese idiom for the guilty party raising the alarm first[10]. Beijing's broader claim is that unproven espionage announcements have become a routine tool of U.S. political messaging, and that treating ordinary commercial recruiting of experts as spying puts every Chinese firm under suspicion.
WhyChina wants to blunt the 'China threat' framing that underpins U.S. export controls, investment screening and allied coordination. It also raises the cost of future U.S. announcements by contesting every one of them[7][10].
Impact on themEach new U.S. counterintelligence action feeds pressure for tighter restrictions on Chinese companies and researchers. If the accusation goes unrebutted, it strengthens the case for those measures regardless of whether charges follow[3][10].
Frames it asThis group's central concern is practical, not geopolitical. Many were laid off or pushed out during large federal workforce reductions and are genuinely job hunting. Their argument is that the burden is being placed on them: they are told to spot a sophisticated fake employer that used real hiring platforms, real-looking company sites and AI-generated staff photos[1][4]. They also warn about overcorrection. If every consulting inquiry becomes suspect, former officials lose legitimate private-sector work and the government loses the goodwill of people it already trained.
WhyKeeping both a clearance and an income. A clearance is a career asset that a bad contact can destroy, so this group wants clear, early guidance rather than after-the-fact enforcement[5][9].
Impact on themReporting has described Russian and Chinese services courting workers cut in the DOGE-era layoffs[9]. That means a population with valuable knowledge, thinner finances and reduced official support is the exact group being approached[5].
Frames it asThe platforms' honest case is scale and ambiguity. Millions of listings post every month, and a fake consulting firm with a working website and a plausible client story looks like an ordinary small employer. The illegal step — asking for insider material — happens later, in private encrypted chats the platform cannot see[1][5]. They argue that broad screening of anyone recruiting people with government backgrounds would block a large, lawful market for cleared talent.
WhyAvoiding both liability and heavy-handed regulation, while keeping listing volume and employer trust intact[5].
Impact on themNamed in a federal affidavit as the channels used — Upwork, Wellfound, Hubstaff Talent, Expertia AI and Post Job Free[5]. That exposure invites congressional questions and pressure to build verification systems they currently do not have.
Like this article?
The Bias Ledger average rating 4.9
The same story, as framed by outlets across the spectrum, ordered least to most biased. The bias score (1 = straight, 10 = heavily spun) is an AI assessment of that framing — click an outlet to see its track record. The tell is the word choice or omission that reveals the angle.
| Outlet | Vantage | Bias | How they frame it | The tell |
|---|---|---|---|---|
| The Washington Post | U.S. center-left | 2 | 'FBI seizes 13 websites that officials say were used by China to target and recruit US workers' | 'Officials say' is placed before the attribution-dependent part, which is careful sourcing. But the piece leans into the domestic layoff context and the AI-generated photos — the vivid, novel detail — over the unresolved legal status of the case. |
| Help Net Security | Trade press for information-security professionals | 2 | 'FBI seizes 13 websites linked to alleged Chinese intelligence-gathering effort' | Uses 'linked to' and 'alleged,' and focuses on tradecraft — platforms, personas, payment routes — rather than geopolitics. Its blind spot is the political context, not the facts. |
| South China Morning Post | Hong Kong-based, owned by Alibaba Group | 3 | 'FBI disables 13 Chinese suspected spying websites targeting US officials' | Keeps 'suspected' and attributes throughout — closer to the record than most U.S. versions. The emphasis choice is placing the case within a running series of U.S.-China accusations, which frames it as one more episode rather than a discrete finding. |
| United States Department of Justice | U.S. government (primary source) | 4 | 'Justice Department, FBI Disable 13 Websites Backed by Suspected Chinese Agents That Sought Sensitive U.S. Information from Security Clearance Holders' | The verb 'disable' and the phrase 'sought sensitive U.S. information' assert a completed act, while the only hedge — 'suspected' — sits mid-headline where readers skim past it. The release never says no one has been charged; that has to be inferred from the absence of names. |
| The Washington Times | U.S. right | 6 | 'FBI shutters covert Chinese websites targeting secrets' | The headline drops 'suspected' and 'alleged' entirely. 'Covert Chinese' states state attribution as settled fact, and 'targeting secrets' upgrades job postings for consultants into an attack on classified material. |
| RedState | U.S. right (opinion-driven site) | 8 | 'FBI Seizes Fake Domains in Devastating New Blow to Chinese Intel Operations' | 'Devastating new blow' is a verdict on effectiveness that no evidence in the record supports — 13 domains can be re-registered cheaply. The framing converts an investigative step into a scored win. |
| Global Times (Opinion) | Chinese state media, published under People's Daily | 9 | 'Hyping up "Chinese espionage threat": A classic case of "thief crying stop thief"' | The editorial answers a specific evidentiary claim with a general counter-accusation about U.S. surveillance. It never engages the 13 domains, the November 2023 start date, or the payment details in the affidavit — omission is the whole method. |
References
- Justice Department, FBI Disable 13 Websites Backed by Suspected Chinese Agents That Sought Sensitive U.S. Information from Security Clearance Holders — United States Department of Justice · U.S. federal government; the accusing party in this matter
- DOJ, FBI Disable 13 Websites Backed by Suspected Chinese Agents (District of Columbia) — U.S. Attorney's Office, District of Columbia · U.S. federal prosecutors; the office that obtained the warrants
- FBI disables 13 Chinese suspected spying websites targeting US officials — South China Morning Post · Hong Kong newspaper owned by Alibaba Group; editorially cautious on Beijing but not a state organ
- FBI seizes 13 websites linked to alleged Chinese intelligence-gathering effort — Help Net Security · Commercial information-security trade publication, vendor-advertising funded
- FBI seizes 13 websites that officials say were used by China to target and recruit US workers — The Washington Post · U.S. center-left national newspaper, privately owned
- FBI Seizes Fake Domains in Devastating New Blow to Chinese Intel Operations — RedState · U.S. conservative opinion site owned by Salem Media Group
- FM rejects US DOJ allegation of so-called 'Chinese intelligence collection' via 13 website domains — Global Times · Chinese state media published under People's Daily, the Communist Party's official paper
- FBI shutters covert Chinese websites targeting secrets — The Washington Times · U.S. conservative newspaper founded by the Unification Church
- Russian and Chinese spies are targeting US federal workers fired in DOGE purges, report says — Business Insider · U.S. center-left business news site owned by Axel Springer
- Hyping up 'Chinese espionage threat': A classic case of 'thief crying stop thief' (editorial) — Global Times · Chinese state media editorial board, published under People's Daily