A paid consulting invitation can also be an intelligence approach

Reporters received offers to write paid analysis or consult on Chinese policy and repression. Some approaches moved from email or LinkedIn to WhatsApp, where inconsistent identities and suspicious links raised further concerns.

ICIJ described these firsthand approaches alongside a Five Eyes bulletin attributing similar cover-company recruitment to Chinese military intelligence. Citizen Lab had also analyzed attacks against the reporting network and related activists. China’s embassy said the country opposed and acted against cyberattacks.

The mechanism begins with an ordinary professional opportunity. Building a relationship can precede a request for privileged information or a malicious document. The reporting distinguishes the observed messages from the broader attribution, rather than assuming every unsolicited consulting offer has the same origin.