MI5 warns of Chinese spies using LinkedIn to gain intel on lawmakers

The U.K.’s domestic security and intelligence agency warned members of the Houses of Parliament on Tuesday that Chinese spies were actively attempting to target them through LinkedIn.

The alert from MI5 was circulated among politicians by the speakers of both the House of Commons and House of Lords.

“This activity involves a covert and calculated attempt by a foreign power to interfere in our sovereign affairs in favour of its own interests, and this government will not tolerate it,” said Security Minister Dan Jarvis before the House of Commons on Tuesday.

The alert identifies two specific LinkedIn profiles, featuring fake personas, that are being used by China’s Ministry of State Security (MSS) — widely believed to be the largest intelligence organization in the world — in an attempt to build relationships in Westminster and gain intelligence.

Jarvis said the spying attempts build “on a pattern of activity that we have seen from China with cyber-operations by China state-affiliated actors targeting parliamentary emails in 2021, attempted foreign interference activity by Christine Lee in 2022 and other more recent cases.”

“We will take all necessary measures to protect our national interests, our citizens and our democratic way of life, including working with our allies and partners,” stressed Jarvis, adding the government was investing £170 million ($224 million) to upgrade encrypted technology for government business, and introducing new protections to tackle Chinese cybercrime and Beijing’s attempts to influence research at British universities.

The LinkedIn profiles, according to MI5, act as “civilian recruitment head-hunters” targeting MPs and peers alongside parliamentary staff, as well as a range of professionals who contribute to policy development such as economists, think tank staff and consultants.

The British government previously publicly accused Chinese state-affiliated hackers with “carrying out malicious cyber activity targeting UK institutions and individuals important to our democracy.”

At the time, the National Cyber Security Centre (NCSC) assessed that the hacking group APT3 — previously attributed to the MSS — had been conducting “online reconnaissance activity” against individuals in the House of Commons and House of Lords who had publicly criticized Beijing.

Sir Lindsay Hoyle, the Speaker of the House of Commons, warned MPs that China was “relentless” in its attempts “to interfere with our processes and influence activity at Parliament,” as reported by BBC News. The letter itself has not been published.

Hoyle said the MSS was “actively reaching out to individuals in our community,” often offering freelance work authoring geopolitical consultancy reports while actually intending to “collect information and lay the groundwork for long-term relationships, using professional networking sites, recruitment agents and consultants acting on their behalf.”

A parliamentary spokesperson told Recorded Future News: “The safety and security of everyone who works in or visits Parliament is our top priority. We provide advice to Members and staff to make them aware of potential risks, however we cannot comment on our security processes, measures, or advice.”

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Alexander Martin

Alexander Martin

is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and is also a fellow at the European Cyber Conflict Research Initiative.

 

Total
0
Shares
Previous Post

Meta Expands WhatsApp Security Research with New Proxy Tool and $4M in Bounties This Year

Next Post

Sneaky 2FA Phishing Kit Adds BitB Pop-ups Designed to Mimic the Browser Address Bar

Related Posts

Fake Booking Emails Redirect Hotel Staff to Fake BSoD Pages Delivering DCRat

Source: Securonix Cybersecurity researchers have disclosed details of a new campaign dubbed PHALT#BLYX that has leveraged ClickFix-style lures to display fixes for fake blue screen of death (BSoD) errors in attacks targeting the European hospitality sector. The end goal of the multi-stage campaign is to deliver a remote access trojan known as DCRat, according to cybersecurity company Securonix.
Read More

New SAP NetWeaver Bug Lets Attackers Take Over Servers Without Login

SAP has rolled out security fixes for 13 new security issues, including additional hardening for a maximum-severity bug in SAP NetWeaver AS Java that could result in arbitrary command execution. The vulnerability, tracked as CVE-2025-42944, carries a CVSS score of 10.0. It has been described as a case of insecure deserialization. "Due to a deserialization vulnerability in SAP NetWeaver, an
Read More