U.S. officials say what may look like a high-paying job offer from a friendly recruiter online could actually be part of a foreign intelligence operation, according to a new warning issued this week.
Revealed in a memo issued by the Air Force Office of Special Investigations (AFOSI) on Monday, such foreign spying efforts are reportedly on the rise, and are increasingly targeting military personnel, veterans, government employees, and contractors through deceptive online job recruitment messages.
The messages are leveraging social media and other online platforms to send what often appear to be legitimate messages that are designed to exploit trust, gather sensitive information, and, over time, compromise U.S. national security.
Foreign Spies Increase Their Efforts
An April 2025 memo issued by the National Counterintelligence and Security Center (NCSC) confirms that hostile foreign spies have been uncovered in a range of intelligence gathering operations that have masqueraded as consulting firms, recruiters, think tanks, and other seemingly legitimate organizations.
“These aren’t random messages. They’re calculated attempts to exploit trust,” an AFOSI counterintelligence analyst who could not be named due to operational security concerns was quoted saying.
“This isn’t a new tactic, it’s just become more aggressive and more refined,” the AFOSI analyst said. “Adversaries have figured out how to blend into legitimate spaces online.”
“Our adversaries are targeting the very people who’ve kept this nation secure,” said Special Agent Lee Russ, executive director of AFOSI’s Office of Special Projects, who warned that seemingly legitimate job offers have repeatedly been revealed to be intelligence operations in disguise.
Slow, Subtle Manipulation
Made to look like they come from otherwise reputable sources, these recruitment messages are often tailored to match a recipient’s specific career backgrounds, displaying what officials say is a degree of credibility.
“The sophistication is what makes it dangerous,” the analyst emphasized. “They use professional norms to approach targets who let their guard down.”
In order to build trust, requests often start with general commentary on policy issues, and may include presentations of generic reports, while offering generous compensation for a modest amount of work, which helps to build trust while driving ongoing engagement.
“They’re not going to ask for secrets right away,” the analyst explained. “They build credibility first, then slowly shift the conversation.
“By the time it feels suspicious, a relationship has already been established—and that’s exactly what they’re counting on.”
Red Flags to Watch For
The AFOSI warns that U.S. personnel who receive recruitment requests should watch out for several factors, which include high compensation for vague or very easy tasks, and requests to engage in communication outside of trusted platforms that include encrypted messaging apps.
Additionally, requests over time may begin to include questions about detailed or restricted information, while often framed under the guise of strategic insights, planning, or market research.
Civilians, contractors, reservists, and even retirees are among those who have been recently targeted by such efforts by foreign spies posing as legitimate recruiters.
“If you’ve ever had access to sensitive material, classified or not, you’re a potential target,” the AFOSI analyst said.
“They’re after any information that could provide a strategic advantage.”
Officials are requesting that personnel who suspect they may have been targeted by a foreign intelligence outfit should not panic or fear punishment but should report it to investigators.
“The most powerful weapon we have is self-reporting,” the AFOSI analyst said.
“When people flag suspicious outreach early, it gives us a fighting chance.”
Micah Hanks is the Editor-in-Chief and Co-Founder of The Debrief. He can be reached by email at micah@thedebrief.org. Follow his work at micahhanks.com and on X: @MicahHanks.