MI5 warns of Chinese spies using LinkedIn to gain intel on lawmakers

The U.K.’s domestic security and intelligence agency warned members of the Houses of Parliament on Tuesday that Chinese spies were actively attempting to target them through LinkedIn.

The alert from MI5 was circulated among politicians by the speakers of both the House of Commons and House of Lords.

“This activity involves a covert and calculated attempt by a foreign power to interfere in our sovereign affairs in favour of its own interests, and this government will not tolerate it,” said Security Minister Dan Jarvis before the House of Commons on Tuesday.

The alert identifies two specific LinkedIn profiles, featuring fake personas, that are being used by China’s Ministry of State Security (MSS) — widely believed to be the largest intelligence organization in the world — in an attempt to build relationships in Westminster and gain intelligence.

Jarvis said the spying attempts build “on a pattern of activity that we have seen from China with cyber-operations by China state-affiliated actors targeting parliamentary emails in 2021, attempted foreign interference activity by Christine Lee in 2022 and other more recent cases.”

“We will take all necessary measures to protect our national interests, our citizens and our democratic way of life, including working with our allies and partners,” stressed Jarvis, adding the government was investing £170 million ($224 million) to upgrade encrypted technology for government business, and introducing new protections to tackle Chinese cybercrime and Beijing’s attempts to influence research at British universities.

The LinkedIn profiles, according to MI5, act as “civilian recruitment head-hunters” targeting MPs and peers alongside parliamentary staff, as well as a range of professionals who contribute to policy development such as economists, think tank staff and consultants.

The British government previously publicly accused Chinese state-affiliated hackers with “carrying out malicious cyber activity targeting UK institutions and individuals important to our democracy.”

At the time, the National Cyber Security Centre (NCSC) assessed that the hacking group APT3 — previously attributed to the MSS — had been conducting “online reconnaissance activity” against individuals in the House of Commons and House of Lords who had publicly criticized Beijing.

Sir Lindsay Hoyle, the Speaker of the House of Commons, warned MPs that China was “relentless” in its attempts “to interfere with our processes and influence activity at Parliament,” as reported by BBC News. The letter itself has not been published.

Hoyle said the MSS was “actively reaching out to individuals in our community,” often offering freelance work authoring geopolitical consultancy reports while actually intending to “collect information and lay the groundwork for long-term relationships, using professional networking sites, recruitment agents and consultants acting on their behalf.”

A parliamentary spokesperson told Recorded Future News: “The safety and security of everyone who works in or visits Parliament is our top priority. We provide advice to Members and staff to make them aware of potential risks, however we cannot comment on our security processes, measures, or advice.”

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Alexander Martin

Alexander Martin

is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and is also a fellow at the European Cyber Conflict Research Initiative.

 

Total
0
Shares
Previous Post

Meta Expands WhatsApp Security Research with New Proxy Tool and $4M in Bounties This Year

Next Post

Sneaky 2FA Phishing Kit Adds BitB Pop-ups Designed to Mimic the Browser Address Bar

Related Posts

ThreatsDay Bulletin: Codespaces RCE, AsyncRAT C2, BYOVD Abuse, AI Cloud Intrusions & 15+ Stories

This week didn’t produce one big headline. It produced many small signals — the kind that quietly shape what attacks will look like next. Researchers tracked intrusions that start in ordinary places: developer workflows, remote tools, cloud access, identity paths, and even routine user actions. Nothing looked dramatic on the surface. That’s the point. Entry is becoming less visible while impact
Read More

OpenClaw Integrates VirusTotal Scanning to Detect Malicious ClawHub Skills

OpenClaw (formerly Moltbot and Clawdbot) has announced that it's partnering with Google-owned VirusTotal to scan skills that are being uploaded to ClawHub, its skill marketplace, as part of broader efforts to bolster the security of the agentic ecosystem. "All skills published to ClawHub are now scanned using VirusTotal's threat intelligence, including their new Code Insight capability,"
Read More