China Warns ‘Welfare’ Pop-Ups Used by Foreign Spies

China’s Ministry of State Security (MSS) issued a stark warning on June 21, 2026, revealing that fraudulent pop-up advertisements promising “welfare benefits” and “free access” are being exploited by foreign intelligence agencies to collect sensitive personal and classified information. The announcement, published through the MSS’s official channels and reported by CCTV News, details a sophisticated espionage operation targeting unsuspecting internet users across China.

Two Espionage Techniques Uncovered

The MSS investigation identified two primary methods being used by foreign spy agencies to exploit everyday online advertising infrastructure.

Personalized Ad Push: When users click on pop-up advertisements, apps transmit personal privacy data, interest characteristics, and other information stored in app databases to advertising companies. The MSS revealed that foreign spy agencies have colluded with individual advertising companies to build monitoring platforms. By integrating ad company data with social media information and high-precision location data, these platforms create detailed profiles of targets — including home addresses, workplaces, and daily travel routes — enabling targeted recruitment and coercion.

Content Distribution Network Exploitation: Foreign spy agencies have embedded links to anti-China websites within pop-up ads, using Content Delivery Network (CDN) nodes in neighboring regions to bypass China’s internet regulatory systems. According to the MSS, this technique allows for covert distribution of ideological infiltration content within China’s domestic network environment, as Phoenix News reported.

Immediate Action Taken

National security authorities have already taken enforcement action, legally ordering relevant online platform operators to immediately cease providing ad delivery services for unidentified foreign links. The MSS stated that this swift response has blocked the potential harm from spreading further.

The warning references two key Chinese regulations: the Internet Pop-up Information Push Service Management Regulations (effective September 30, 2022) and the Internet Advertising Management Measures (2023). These regulations require pop-up ads to be clearly identifiable, marked with “Ad” labels, and equipped with one-click close buttons.

Broader Cybersecurity Context

This warning is the latest in a series of public disclosures by China’s MSS regarding evolving espionage threats. In recent months, the agency has warned about “invoice trap” phishing emails, router-based network attacks, online dating and gaming recruitment of spies, and even maritime espionage using sensor-equipped animals. The proactive disclosure of these techniques serves both as a public warning and as a deterrent to the foreign agencies involved, as Sina News noted.

China has established a comprehensive legal framework for cybersecurity, including the Cybersecurity Law (2017), Data Security Law (2021), and Personal Information Protection Law (2021). The MSS has been actively promoting public awareness through its WeChat account, the 12339 hotline, and the www.12339.gov.cn reporting platform.

Public Guidance

The MSS advises users to take several protective measures:

• Disable unnecessary app permissions (location, photo album, contacts)
• Reset device advertising identifiers and disable ad tracking
• Avoid clicking “View Details” or “Claim Benefits” buttons in pop-ups
• Report suspicious content via the 12339 hotline, www.12339.gov.cn, or the MSS WeChat account

Analysis and Implications

The use of common pop-up advertisements — a mundane, everyday internet experience — as a vector for intelligence gathering represents a sophisticated and previously under-publicized threat. The revelation that foreign spy agencies have colluded with individual advertising companies highlights vulnerabilities in China’s digital advertising ecosystem.

The exploitation of CDN infrastructure to bypass China’s internet censorship is a particularly notable technical detail, suggesting sophisticated operational capabilities on the part of the foreign agencies involved. The MSS’s decision to publicly disclose these techniques reflects an ongoing effort to combat increasingly sophisticated foreign espionage tactics in the digital domain.

What to Watch For

In the short term, increased scrutiny of pop-up advertisements and advertising technology companies in China is expected, potentially followed by regulatory crackdowns on ad tech firms. Medium-term implications may include tighter CDN regulations and cross-border data flow restrictions. The MSS has not named the specific foreign intelligence agencies involved, nor disclosed how long the operation had been active before detection — details that may emerge as investigations continue.

This story underscores the evolving nature of cyber espionage, where everyday digital experiences can become vectors for national security threats. As the MSS continues its public awareness campaign, the line between routine online activity and potential espionage risk grows increasingly important for ordinary internet users to understand.