MI5 warns of Chinese spies using LinkedIn to gain intel on lawmakers

The U.K.’s domestic security and intelligence agency warned members of the Houses of Parliament on Tuesday that Chinese spies were actively attempting to target them through LinkedIn.

The alert from MI5 was circulated among politicians by the speakers of both the House of Commons and House of Lords.

“This activity involves a covert and calculated attempt by a foreign power to interfere in our sovereign affairs in favour of its own interests, and this government will not tolerate it,” said Security Minister Dan Jarvis before the House of Commons on Tuesday.

The alert identifies two specific LinkedIn profiles, featuring fake personas, that are being used by China’s Ministry of State Security (MSS) — widely believed to be the largest intelligence organization in the world — in an attempt to build relationships in Westminster and gain intelligence.

Jarvis said the spying attempts build “on a pattern of activity that we have seen from China with cyber-operations by China state-affiliated actors targeting parliamentary emails in 2021, attempted foreign interference activity by Christine Lee in 2022 and other more recent cases.”

“We will take all necessary measures to protect our national interests, our citizens and our democratic way of life, including working with our allies and partners,” stressed Jarvis, adding the government was investing £170 million ($224 million) to upgrade encrypted technology for government business, and introducing new protections to tackle Chinese cybercrime and Beijing’s attempts to influence research at British universities.

The LinkedIn profiles, according to MI5, act as “civilian recruitment head-hunters” targeting MPs and peers alongside parliamentary staff, as well as a range of professionals who contribute to policy development such as economists, think tank staff and consultants.

The British government previously publicly accused Chinese state-affiliated hackers with “carrying out malicious cyber activity targeting UK institutions and individuals important to our democracy.”

At the time, the National Cyber Security Centre (NCSC) assessed that the hacking group APT3 — previously attributed to the MSS — had been conducting “online reconnaissance activity” against individuals in the House of Commons and House of Lords who had publicly criticized Beijing.

Sir Lindsay Hoyle, the Speaker of the House of Commons, warned MPs that China was “relentless” in its attempts “to interfere with our processes and influence activity at Parliament,” as reported by BBC News. The letter itself has not been published.

Hoyle said the MSS was “actively reaching out to individuals in our community,” often offering freelance work authoring geopolitical consultancy reports while actually intending to “collect information and lay the groundwork for long-term relationships, using professional networking sites, recruitment agents and consultants acting on their behalf.”

A parliamentary spokesperson told Recorded Future News: “The safety and security of everyone who works in or visits Parliament is our top priority. We provide advice to Members and staff to make them aware of potential risks, however we cannot comment on our security processes, measures, or advice.”

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Alexander Martin

Alexander Martin

is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and is also a fellow at the European Cyber Conflict Research Initiative.

 

Total
0
Shares
Previous Post

Meta Expands WhatsApp Security Research with New Proxy Tool and $4M in Bounties This Year

Next Post

Sneaky 2FA Phishing Kit Adds BitB Pop-ups Designed to Mimic the Browser Address Bar

Related Posts

Warning: WinRAR Vulnerability CVE-2025-6218 Under Active Attack by Multiple Threat Groups

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a security flaw impacting the WinRAR file archiver and compression utility to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2025-6218 (CVSS score: 7.8), is a path traversal bug that could enable code execution. However, for exploitation
Read More

JPCERT Confirms Active Command Injection Attacks on Array AG Gateways

A command injection vulnerability in Array Networks AG Series secure access gateways has been exploited in the wild since August 2025, according to an alert issued by JPCERT/CC this week. The vulnerability, which does not have a CVE identifier, was addressed by the company on May 11, 2025. It's rooted in Array's DesktopDirect, a remote desktop access solution that allows users to securely access
Read More

Automated FortiGate Attacks Exploit FortiCloud SSO to Alter Firewall Configurations

Cybersecurity company Arctic Wolf has warned of a "new cluster of automated malicious activity" that involves unauthorized firewall configuration changes on Fortinet FortiGate devices. The activity, it said, commenced on January 15, 2026, adding it shares similarities with a December 2025 campaign in which malicious SSO logins on FortiGate appliances were recorded against the admin account from
Read More