China's Hacking Your Video Calls and Sliding Into LinkedIn DMs: A Cyber Spy Romance

This is your Red Alert: China's Daily Cyber Moves podcast. # Red Alert: China's Daily Cyber Moves Listen, we're looking at a serious escalation in Chinese cyber operations targeting US infrastructure, and the timing couldn't be more critical. Just this past week, the FBI declared a China-linked intrusion into a sensitive US surveillance system a major incident, meaning we're talking significant risks to national security. This isn't theoretical anymore, listeners. This is happening right now. Let me break down what's actually on the ground. CheckPoint Research just identified Operation TrueChaos, a coordinated campaign where Chinese-nexus threat actors exploited a zero-day vulnerability in TrueConf, a videoconferencing platform used heavily by government agencies. The vulnerability, tracked as CVE-2026-3502 with a severity score of 7.8, allows attackers who control on-premises servers to distribute malicious updates across all connected endpoints. What makes this particularly nasty is that researchers found a compromised TrueConf server operated by a governmental IT department that was serving dozens of government entities simultaneously. One malicious update poisoned the entire network. CISA immediately added this to their Known Exploited Vulnerabilities catalog, but the damage was already spreading. The attack pattern here is classic Chinese tradecraft. They're using DLL sideloading, Alibaba and Tencent infrastructure for command and control, and deploying the Havoc payload to establish persistence. The same victims were also hit by ShadowPad, suggesting either shared access or multiple Chinese-linked actors coordinating their efforts. This is coordinated, sophisticated, and deliberate. But here's where it gets darker. The FBI is also alerting about foreign-developed mobile apps maintaining digital infrastructure in China. As of early 2026, many of the most downloaded apps in the United States are developed by Chinese companies, and they're subject to China's extensive national security laws. That means the Chinese government can potentially access the data of millions of American users through apps we use every day without thinking twice about it. Meanwhile, the NCSC and international partners are issuing urgent actions for individuals at risk of targeted attacks against messaging apps. Chinese intelligence services are literally using fake LinkedIn profiles to recruit sources in Belgium for NATO and EU intelligence. This is espionage infrastructure being built in real time. The timeline here matters. We're seeing sustained pressure from mid-2025 onward with TA416 resuming European government targeting, now pivoting back toward US critical infrastructure. The escalation pattern suggests we're moving into a more aggressive posture from Beijing. What do we do? Patch CVE-2026-3502 immediately if you're running TrueConf. Audit your supply chains. Assume your videoconferencing platforms are potential attack vectors. Monitor for ShadowPad in This content was created in partnership and with the help of Artificial Intelligence AI.