Insider recruitment has become a business. Across criminal forums and messaging platforms, recruiters, brokers and service sellers compete to turn employee access into criminal capability. The conventional picture of insider risk, a “disgruntled” or “departing employee”, no longer tells the full story. Threat actors now seek out employees who can perform specific actions on their behalf, pay referral fees to anyone who can introduce them and in some cases try to place recruits inside their targets’ organizations before any access exists. In effect, it operates like a staffing agency for crime.
Our September 2026 research report, “Insiders for Hire: Underground Recruitment, Access Claims and Insider-Enabled Services” analyzed 85 insider-related threat actors from August 25, 2025 to August 23, 2026.
Cybersecurity professionals should be aware that insider risk can begin before access is ever granted, during recruitment or even hiring, making prevention, not just detection essential. Threat actors are often focused on outcomes, not just credentials: a SIM swap that moves a victim’s phone number to a criminal’s SIM card, a customer check or transaction approved by a know your customer (KYC) employee, an account reset by a support agent, or a shipment held or rerouted by a logistics worker. A better understanding of how criminal forums foster malicious insiders gives cybersecurity teams the necessary tools to reduce and prevent insider risks.
Illicit Recruitment of Insider Threats
Just as companies use recruiters and staffing agencies to fill roles, threat actors mirror legitimate business practices through dark web forums and markets to find, vet and pay employees who can do specific tasks for them.
One of the most noteworthy findings from our recent report reveals that 53% of insider-related activity we analyzed was on recruitment, which is more than access, data sales, services and partnerships combined. Much of this ecosystem is focused on identifying, approaching or connecting people who can provide specific internal capabilities, not employees independently selling access.
Increasingly, criminal forums and specialist marketplaces are hosting discussions focused on recruiting for decisive actions: accessing sensitive information, compromising accounts, conducting SIM swaps, intercepting shipments and enabling other types of fraud. Many actors sell these actions as finished services, such as an account reset or a shipment hold, rather than selling access itself. This approach shields the insider’s identity and enables reusable capabilities across many transactions.
For example, on July 6, 2026, the FaultyPig threat actor offered a $50,000 referral fee for an introduction to a single employee working KYC or compliance at a cryptocurrency exchange.
Threat actors do not always rely on recruiting existing employees, some try to place one themselves. In another instance, a threat actor recruited unemployed U.S. residents to apply for customer support jobs at a major U.S. phone carrier, where they could conduct SIM swaps in exchange for 20% of the proceeds.
These trends demonstrate that insider risk increasingly emerges during the hiring process, long before access is ever granted.
Inside the Insider Economy
Payment models have evolved to incentivize insiders to become partners, not just one-time interactions, with criminal enterprises through referral fees and revenue sharing.
The ShadowByt3$ group advertised a formal insider and affiliate program, offering up to 85% of the proceeds while the group handled extortion. The group rebranded as an extortion-as-a-service (EaaS) operation, relying on malicious insiders to compensate for a lack of in-house intrusion capabilities.
Brokers are offering recruitment as a service. On April 28, 2026, the “nolimit” threat actor advertised the ability to identify and recruit targeted insiders at specific companies to deliver unauthorized access or information.
Mirroring legitimate business models, these operations leverage specialized roles across a network of recruiters, brokers, self-proclaimed insiders, malicious service providers and operational partners. Criminal forums, such as Exploit and Dread, support the widest range of insider threat activity. Messaging platforms, such as Telegram, and other specialist marketplaces focus more on social media services, such as account recovery and lifting account bans.
When it comes to specific industries, the leads we analyzed most often referenced transportation (22%), technology (20%) and telecommunications (18%) the most, reflecting the value of repeatable operational workflows within these critical infrastructure sectors. Shipping staff can hold or reroute packages, phone carrier staff can move phone numbers and reset accounts, and technology staff control user data and account access.
Insiders and the Financial Sector
Financial organizations show how insiders are used across the full criminal operation. In our research, insiders were sought in various ways:
Threat actors are often recruited by role, seeking tellers, bank managers and identity-verification staff for the specific actions their positions allow. One actor wanted a teller able to pull up a specific customer’s account and transaction history.
Others treated insider access as an ongoing service. One actor sought an arrangement with a bank employee who would look up specified individuals on request, returning a few records at a time rather than an entire database. Another claimed access to a bank employee who could approve loans of up to 300,000 euros.
Insiders were also used to enable attacks carried out by others. Recruits sought for jobs at phone carriers were meant to conduct SIM swaps to cash out compromised bank accounts, while other actors sought insiders to support fraudulent loan applications.
For more on threats facing financial institutions, see our report “Follow the Money: Cyber Threats to the Financial Sector.”
Protecting Workflows from Insider Threats
To counter insider threats, organizations first need to understand what threat actors are buying. The market for criminal insiders has evolved from compromised credentials to full organizational capabilities. This explains why recruitment is the most common insider activity, and why support staff, KYC employees, logistics workers, moderators and tellers are targeted alongside IT administrators.
Insiders use normal access and normal workflows, so traditional security tools rarely flag them. Your alarm doesn’t go off when someone uses their own key. To protect these outcomes, organizations should focus on detecting unusual volumes of password resets, SIM changes or customer lookups by a single employee, especially without a matching service ticket. Other warning signs include lookups on customers outside an employee’s assigned accounts and repeated small lookups on specific people.
Additionally, organizations should focus on identifying which roles and responsibilities could be valuable to a threat actor, rather than limiting insider risk programs to conventionally privileged users. Pragmatically, this means combining least privilege and a separation of duties with detailed logging, secondary approval for high-risk actions and behavioral monitoring to detect anomalous use of legitimate functions.
Organizations in high-risk sectors must also consider using threat intelligence to track recruitment activity that targets their organization, industry or specific employee roles. Increased criminal demand for certain operational capabilities can serve as an early warning of insider risk. This intelligence can be correlated with internal telemetry for enhanced detection.
Ultimately, recruitment ads on criminal forums are not proof of compromise, but they are a cause for concern. Organizations tuned into these signals can better protect the workflows threat actors want to control, and are better positioned to prevent, deter and detect insider threats.
Join our LinkedIn group Information Security Community!
——————————————————-
Click Here For The Original Source.
