NextFin News - Chinese intelligence services have successfully infiltrated the professional networks of dozens of European Union and NATO employees, using a sophisticated web of fake LinkedIn profiles to harvest sensitive data and recruit high-level sources. A European security source confirmed on Friday that the operation, orchestrated by Beijing’s Ministry of State Security (MSS), utilized fictitious recruiters to approach officials with lucrative consulting offers, marking a significant escalation in China’s long-term human intelligence strategy in Europe.
The investigation, first detailed by Intelligence Online and subsequently confirmed by security officials in Brussels and Paris, centers on a highly active profile under the name "Kevin Zhang." Claiming to be the head of a Hong Kong-based firm called "Oriental Consulting," Zhang and similar accounts targeted individuals with access to classified information or strategic decision-making processes. According to the security source cited by AFP, the recruitment process followed a disciplined, gradualist approach: an initial credible job offer, followed by a paid assignment ranging from €700 to €1,000, and eventually a request for non-public documents or internal contact lists.
This digital-first approach to human intelligence represents a departure from the more aggressive, visible tactics often associated with Russian operations. While Moscow frequently employs hacking and disinformation to achieve immediate political disruption, Beijing’s LinkedIn-based campaign appears designed for long-term institutional penetration. By embedding agents within the professional trust networks of the EU and NATO, the MSS aims to reconstruct internal dynamics and anticipate future policy shifts rather than merely stealing static data points.
The effectiveness of these campaigns relies on the inherent vulnerability of professional social networks, where users are incentivized to share detailed career histories and connect with unknown recruiters. William Evanina, the former head of U.S. counterintelligence who has long tracked Chinese digital recruitment, previously characterized such efforts as "super aggressive." Evanina’s historical analysis suggests that these operations are rarely isolated incidents but part of a systemic "fishing" strategy that has already claimed high-profile victims, including former CIA officer Kevin Mallory, who was recruited via LinkedIn before his 2019 conviction.
European security agencies are now grappling with the structural challenge of monitoring these "gray zone" interactions. Unlike traditional espionage conducted through embassies, digital recruitment occurs in a space where the line between legitimate business consulting and intelligence gathering is intentionally blurred. Intelligence Online reports that several European nationals have already been successfully recruited, moving beyond the initial "consulting" phase into active information sharing. The focus on NATO and EU Commission staff suggests a specific interest in Western military coordination and trade policy toward the Indo-Pacific.
However, some security analysts urge caution in overstating the novelty of these tactics. While the scale and funding of the "Kevin Zhang" operation are notable, the underlying methodology—using front companies and financial incentives to compromise officials—is a classic intelligence tradecraft adapted for the 21st century. The primary shift is the platform; LinkedIn provides a global, searchable database of targets that would have taken traditional spies years to compile. The challenge for European institutions is no longer just securing their servers against hackers, but securing their staff against the allure of a well-timed, well-paid, and seemingly professional career opportunity.
Explore more exclusive insights at nextfin.ai.
