Singapore-registered firm used fake employees and recruitment methods mirroring foreign intelligence playbook

The company, called Infoassa, had advertised at least six events at its premises over the last four months. Checks by CNA found that the most recent event on Aug 7 never took place.

SINGAPORE: At first, nothing about the job advertisement seemed unusual to Maria, a former United States government employee. With her history of working on Indo-Pacific issues, the remote policy analyst role at Infoassa, a think-tank supposedly based in Singapore, seemed perfectly aligned with her background and research interests.

But in the weeks after sending in her application in mid-July, her suspicions began to mount.

The representative from Infoassa had replied from a personal Gmail account, not an organisational one. He offered US$500 as “reward” if she passed a writing test based on a planned September summit between US President Donald Trump and his Chinese counterpart Xi Jinping, which included a request to analyse Washington’s “pressure tactics” without using publicly available information.

She couldn’t find much about Infoassa online beyond its website, and friends in think-tank circles told her they’d never heard of it. Then there was a distant memory from early in her career: A cautionary tale she’d heard about an American graduate student tapped to become part of an espionage operation.

That's when it dawned on Maria, who requested that she not be identified by her real name in this piece: What if this was a recruitment attempt by a foreign intelligence agency?

“I thought, what if this is part of a broader pattern? Maybe it starts with benign reports, and then that’s how they hook you in,” she told CNA in an interview.

Infoassa began establishing its online presence from September 2025, when it registered its domain name. Across its website and recruitment advertisements, it has alternated between calling itself a "think-tank" and a "consulting firm" over the months, though consistent in a description of being online-only and supposedly drawing on a global network of experts.

But behind that front, a CNA investigation found a constellation of suspicious elements: At least one employee with falsified work history, fake Facebook events with descriptions lifted from articles by other organisations, and several features in its website infrastructure shared with TheTruthInfo, a website seized by US authorities in June.

Twelve other websites were disabled at the same time, as part of what the US claimed to be a Chinese intelligence recruitment operation that targeted Americans with access to classified and sensitive government information.

Responding swiftly in an editorial, Chinese state-owned newspaper Global Times dismissed the internet domain seizures as “baseless” and part of US efforts to exaggerate spying threats posed by China.

The Infoassa playbook mimics other previously reported fake think-tanks, including one which also claimed to be based in Singapore, the Institute of East Asia Strategic Studies (IEASS). These entities used fabricated personas to recruit people with backgrounds in government, think-tanks and international affairs research.

Dr Bill Hayton, an associate fellow at the British think-tank Chatham House, raised concerns about Infoassa in a post on X on Tuesday (Aug 4). He had previously sounded the alarm about IEASS in late June.

Shortly after his post, Infoassa’s website went dark.

CNA’s investigation found no definitive evidence of a connection between Infoassa and IEASS, or of shared ownership between Infoassa and TheTruthInfo. The ultimate operator behind Infoassa could not be determined.

CNA has reached out to Singapore's Ministry of Home Affairs and Ministry of Digital Development and Information for comment.

FAKED STAFF, EVENTS

Infoassa’s online presence pointed to several anomalies which quickly unravelled with some probing.

On its Facebook page, which was active as of Friday, Infoassa advertised at least six events at its premises in Beach Road, all of which focused on geopolitical developments. CNA however found that the event descriptions had been lifted word-for-word from articles published by other organisations, such as the US-based Council on Foreign Relations. Checks by CNA for such an event advertised for Friday afternoon found that it had never taken place.

CNA also identified four online personas claiming to be employees of, or affiliated with, Infoassa. None had an independent online presence outside of Infoassa literature and self-reported LinkedIn profiles.

One persona named James Scoot was flagged by Dr Hayton for claiming, in a now-deactivated LinkedIn profile, to have worked for the government affairs consulting firm Vriens & Partners and the Institute of Southeast Asian Studies think-tank. Checks with both organisations confirmed that no such individual had ever been employed there.

Deepfake testing of the profile picture attached to Scoot’s page, along with that of the only other Infoassa persona with a profile picture, further flagged them as likely to be fake or AI-generated.

Experts told CNA that the apparent unsophistication of such efforts is rarely of concern to the operators behind them.

“It’s a low-cost, set-and-forget kind of system that is easily discardable,” said Associate Professor Dylan Loh from Nanyang Technological University’s (NTU) Public Policy and Global Affairs programme, who added that AI has made it easier to create such front organisations en masse. “There are certainly more sophisticated ways of intelligence-gathering, but those require more resources and manpower.”

Some of these operations are also carried out by for-profit intermediaries on behalf of state actors, said Assoc Prof Loh, and these contractors “sometimes do not put as much care and attention into the endeavour as one might expect”.

“In any case, they can afford to be amateurish, so to speak, because you don’t need an 80 or 90 per cent recruitment rate. You just need one or two good sources that could prove quite consequential.”

HIGH-VALUE TARGETS

Infoassa’s job advertisements, which it has been posting since as early as January, reflect a clear target profile: Individuals with former government, military, parliamentary or think-tank experience, and often with expertise in international relations or security studies.

CNA found multiple such advertisements on various job boards. These included the US-based Workable and the Taiwanese platform Cake.me, as well as in online communities such as Effective Altruism and Jobs That Are Left, which cater to candidates seeking opportunities in politically progressive organisations.

The posts mostly sought applicants for remote, part-time roles like the one Maria applied for, and for a pay of between US$1,500 to US$4,000 per month. In her case, although she had already decided not to move forward with her application, Infoassa sent her a recruitment offer anyway, which included a writing test. In the test brief, seen by CNA, Maria was asked to complete a 1,500 word report primarily pertaining to US considerations ahead of an upcoming Trump-Xi summit in September.

She told CNA the brief unsettled her further. In addition to stilted English and awkward formatting, it asked her to “try to avoid using open-source information” and to “indicate the source of the information” provided. She did not get back to Infoassa.

“I thought, at best, they’re trying to steal my work,” said Maria. At worst, she suspected it was a foreign intelligence recruitment effort.

In addition to Maria, CNA identified one other American individual with public policy and government affairs experience who had applied to Infoassa, although the outcome of their application could not be confirmed.

Infoassa is just one manifestation of a long-running issue which has plagued law enforcement authorities in multiple jurisdictions for years. Its approach aligns with the methods outlined by the Five Eyes, an intelligence-sharing partnership between Australia, New Zealand, Canada, the UK, and the US. In a June bulletin, the group warned of Chinese military intelligence services using front companies to target individuals with access to privileged information.

After initial outreach, recruiters ask interviewees to complete tests, often on issues like foreign relations or geopolitical affairs. At the interview, or in subsequent reports, candidates are then asked about their access to government contacts or more classified information.

Such hiring processes have been in the spotlight previously. In 2020, Singaporean Dickson Yeo was sentenced to jail by US authorities for acting as a foreign agent on behalf of China. Yeo had used LinkedIn to identify and recruit former US government and military employees, some of whom were in financial distress, before paying them sums in the thousands to write reports.

In its June editorial, the Global Times claimed "the narrative of 'China spy threat' is nothing more than a case of 'thief crying stop thief'".

"As the world's largest intelligence-sharing network, the Five Eyes alliance has long conducted large-scale, systematic espionage operations across the globe," it added. "The continued promotion of the so-called 'China spy threat’ theory by the US and the Five Eyes alliance suggests that confrontational and even competitive thinking still dominates parts of their China policy.”

A REAL COMPANY

Unlike other recently identified suspicious Singapore-based think-tanks, which relied on an online-only presence with no actual roots here, Infoassa has established local corporate infrastructure.

Filings from the Accounting and Corporate Regulatory Authority (ACRA) show Infoassa was originally incorporated in August 2024 as a holding company under a different name, Xinhaiyi Pte Ltd. It adopted the Infoassa legal name in October 2025. Its registered address at the Gateway East building in Beach Road remained unchanged, and maps to a corporate secretarial services provider.

According to ACRA's records, ownership of Infoassa then changed hands in late May, when the company became solely owned by a foreign national whom CNA is not naming for legal reasons.

CNA visited Infoassa’s registered office address on Aug 5 and found only the signage of the corporate secretarial services provider. No signboard, logo or publicly observable artefact related to Infoassa could be found.

CNA has sought comment from Infoassa and its listed owner.

**ONLINE CONNECTIONS **

Analysis of Infoassa’s website infrastructure also found several shared features with the US-seized website TheTruthInfo.

In the US, a website seizure means the government has taken legal control of the site’s domain name. Law enforcement obtains a court-issued warrant which requires the domain registrar to take steps to redirect visitors to a "takeover page" informing of the seizure.

CNA found that both Infoassa and TheTruthInfo sites used the same distinctive administrator email address from the Proton service provider. The sites also shared distinctive backend machinery, such as their systems for loading content like articles and images. Several of these were already in place in Infoassa’s infrastructure well before TheTruthInfo’s seizure by US authorities.

These technical links do not, however, amount to the sites having the same controller or operator.

Infoassa’s underlying website code also contained a configuration for simplified Chinese, despite the website being entirely in English.

An independent analysis carried out by Mr Max Lesser, a senior analyst at the US-based Foundation for Defense of Democracies think-tank, corroborated these findings.

Mr Lesser, who studies malign foreign influence and information warfare, told CNA that repeated media and law enforcement scrutiny of fake think-tanks and their tactics did not make them any less attractive of an option to the people behind them.

“This activity continues even after it is exposed because, quite frankly, there is no reason for the actors to stop. The methods still work and the costs remain low,” he said. Moreover, if a domain is exposed but not seized by the authorities, its operators can simply keep using it, he noted.

“They may continue to use exposed infrastructure because they assume that most people have not read the threat research that researchers publish, or that most people will not even run a simple Google search before accepting paid work from a company.”

NTU’s Assoc Prof Loh added that the constant set-up and dismantling of these fronts can also be a learning process for the operators themselves. “It’s by no means a new playbook, but after a report comes out, they can move on to refine their efforts.”