Federal authorities shut down 13 internet domains allegedly operated by fake consulting firms targeting U.S. government and military employees to gather intelligence for Chinese agents.
The FBI announced the domain seizures on Wednesday as part of an ongoing operation to disrupt foreign espionage efforts. According to the U.S. Justice Department, the fake consulting firms posed as legitimate recruitment and staffing agencies to solicit sensitive information from federal employees and military personnel.
The seized domains were used to create phishing websites and conduct social engineering attacks designed to compromise government workers. Investigators determined the operation was connected to agents working on behalf of the Chinese government, though specific details about the intelligence targets remain limited.
This action reflects growing concerns among U.S. officials about foreign intelligence operations targeting American government and defense sectors. Chinese government-linked groups have increasingly relied on digital deception tactics—including fake job postings, business fronts, and recruitment scams—to identify and compromise federal employees with access to classified information.
The FBI advises government workers to exercise caution when contacted by unfamiliar recruitment firms, particularly those offering unusually attractive positions or requesting detailed background information. Employees are encouraged to verify any job opportunities through official channels and report suspicious solicitations to their agency's security office.
The domain seizure is part of a broader federal initiative to combat foreign influence operations and protect national security. Similar operations have targeted Iranian and Russian intelligence activities in recent years, though operations attributed to Chinese entities have increased in frequency and sophistication.
The Justice Department did not release the specific domain names or provide additional details about the scope of the intelligence-gathering operation. An investigation into the full extent of the scheme remains ongoing.
D-Link has alerted users of a maximum-severity zero-day vulnerability (CVE-2026-86296) affecting DIR-822A dual-band Wi-Fi routers. The flaw has no available patch and public exploit code is already circulating.
A cross-site request forgery (CSRF) vulnerability in WordPress Core, dubbed 'Click2Shell,' enables attackers to execute PHP code on vulnerable servers. Technical details and working exploits are now public.
The ShinyHunters extortion group took control of the dark web leak site belonging to the prolific Cl0p ransomware gang over the weekend. The attackers set an eight-figure extortion demand pegged at 2.333% of Cl0p's estimated net worth.
The FBI's CJIS Security Policy v6.1 strengthens encryption requirements and vulnerability scanning mandates. Agencies must prepare for updated password, MFA, and identity verification standards ahead of compliance audits.