MI5 warns of Chinese spies using LinkedIn to gain intel on lawmakers

The U.K.’s domestic security and intelligence agency warned members of the Houses of Parliament on Tuesday that Chinese spies were actively attempting to target them through LinkedIn.

The alert from MI5 was circulated among politicians by the speakers of both the House of Commons and House of Lords.

“This activity involves a covert and calculated attempt by a foreign power to interfere in our sovereign affairs in favour of its own interests, and this government will not tolerate it,” said Security Minister Dan Jarvis before the House of Commons on Tuesday.

The alert identifies two specific LinkedIn profiles, featuring fake personas, that are being used by China’s Ministry of State Security (MSS) — widely believed to be the largest intelligence organization in the world — in an attempt to build relationships in Westminster and gain intelligence.

Jarvis said the spying attempts build “on a pattern of activity that we have seen from China with cyber-operations by China state-affiliated actors targeting parliamentary emails in 2021, attempted foreign interference activity by Christine Lee in 2022 and other more recent cases.”

“We will take all necessary measures to protect our national interests, our citizens and our democratic way of life, including working with our allies and partners,” stressed Jarvis, adding the government was investing £170 million ($224 million) to upgrade encrypted technology for government business, and introducing new protections to tackle Chinese cybercrime and Beijing’s attempts to influence research at British universities.

The LinkedIn profiles, according to MI5, act as “civilian recruitment head-hunters” targeting MPs and peers alongside parliamentary staff, as well as a range of professionals who contribute to policy development such as economists, think tank staff and consultants.

The British government previously publicly accused Chinese state-affiliated hackers with “carrying out malicious cyber activity targeting UK institutions and individuals important to our democracy.”

At the time, the National Cyber Security Centre (NCSC) assessed that the hacking group APT3 — previously attributed to the MSS — had been conducting “online reconnaissance activity” against individuals in the House of Commons and House of Lords who had publicly criticized Beijing.

Sir Lindsay Hoyle, the Speaker of the House of Commons, warned MPs that China was “relentless” in its attempts “to interfere with our processes and influence activity at Parliament,” as reported by BBC News. The letter itself has not been published.

Hoyle said the MSS was “actively reaching out to individuals in our community,” often offering freelance work authoring geopolitical consultancy reports while actually intending to “collect information and lay the groundwork for long-term relationships, using professional networking sites, recruitment agents and consultants acting on their behalf.”

A parliamentary spokesperson told Recorded Future News: “The safety and security of everyone who works in or visits Parliament is our top priority. We provide advice to Members and staff to make them aware of potential risks, however we cannot comment on our security processes, measures, or advice.”

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Alexander Martin

Alexander Martin

is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and is also a fellow at the European Cyber Conflict Research Initiative.

 

Total
0
Shares
Previous Post

Meta Expands WhatsApp Security Research with New Proxy Tool and $4M in Bounties This Year

Next Post

Sneaky 2FA Phishing Kit Adds BitB Pop-ups Designed to Mimic the Browser Address Bar

Related Posts

Smishing Triad Linked to 194,000 Malicious Domains in Global Phishing Operation

The threat actors behind a large-scale, ongoing smishing campaign have been attributed to more than 194,000 malicious domains since January 1, 2024, targeting a broad range of services across the world, according to new findings from Palo Alto Networks Unit 42. "Although these domains are registered through a Hong Kong-based registrar and use Chinese nameservers, the attack infrastructure is
Read More

Fortinet Warns of New FortiWeb CVE-2025-58034 Vulnerability Exploited in the Wild

Fortinet has warned of a new security flaw in FortiWeb that it said has been exploited in the wild. The medium-severity vulnerability, tracked as CVE-2025-58034, carries a CVSS score of 6.7 out of a maximum of 10.0. "An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb may allow an authenticated attacker to execute
Read More