Job Scams Target Current, Former U.S. DoD Employees To Steal Intel

Foreign adversaries use fake consulting jobs on social media to gather sensitive information from U.S. government personnel

Current and former U.S. Department of Defense employees, particularly from the Air Force, are being targeted in deceptive job scams orchestrated by hostile foreign intelligence entities, officials warned in April. These schemes, disguised as recruitment efforts from fake consulting firms and think tanks, aim to collect sensitive information through social engineering.

“These aren’t just job offers, they’re intelligence operations in disguise,” said Special Agent Lee Russ, executive director of the Air Force Office of Special Investigations (AFOSI) Office of Special Projects.

According to a recent memo from the National Counterintelligence and Security Center (NCSC), adversaries use social media, email, and job platforms to reach out directly to individuals with past or current access to sensitive material.

“They’re exploiting online freedoms and professional norms to build trust,” said a counterintelligence analyst at the AFOSI Center, whose name was withheld for security reasons. “These aren’t random messages. They’re calculated attempts to exploit trust.”

The analyst explained that foreign actors typically start with what appears to be a legitimate inquiry aligned with a target’s professional background. These engagements can begin innocently, often offering high pay, flexible work hours, or quick hiring.

“Targets are asked to write reports or offer commentary on general topics,” Russ said. “But over time, these requests escalate—potentially helping foreign actors refine their tactics and operations.”

What makes these campaigns effective, officials say, is their gradual nature.

“They won’t ask for secrets outright,” the analyst noted. “They build credibility, normalize interaction, and then slowly introduce more sensitive requests.”

Red flags often include offers with unusually high pay for minimal effort, a push to move conversations to encrypted apps, or urgency tactics like limited-time offers.

“The goal is to bypass vetting and rush someone into a compromising situation,” Russ said.

Even those who ignore such messages are encouraged to report them.

“Just knowing about the contact helps us understand how these tactics work,” the analyst added. “Self-reporting is critical.”

These schemes have expanded beyond active-duty personnel to include reservists, civilian employees, contractors, and retirees.

“If you’ve ever held a clearance, you’re a potential target,” the analyst warned. “They’re not just after classified data—they want anything that gives them an edge.”

Officials emphasized the role of personal vigilance and early reporting, noting that counterintelligence efforts cannot rely solely on investigations. Programs like Eagle Eyes are in place to help personnel and civilians report suspicious behavior quickly.

“In today’s fight, vigilance online can be just as vital as readiness on the battlefield,” Russ said.