For the report, TrendAI researchers Mayra Rosario Fuentes, Stephen Hilt, and David Sancho examined how the trade of insider access is organized in the underground. Their finding: What were once isolated incidents have become a mature, specialized business—with fixed prices, profit-sharing, referral bonuses, and long-term partnerships that resemble a regular industry more than classic cybercrime.
"The simplest way into a company today doesn't necessarily lead through a security vulnerability—often, an employee is enough. In the cybercrime underground scene, trusted access is increasingly traded like a commodity: Criminals specifically recruit insiders who can circumvent security measures simply through their regular work. Protecting against insider threats today also means recognizing that one's employees themselves have become targets," explains David Sancho, Senior Threat Researcher at TrendAI.
The key insights at a glance:
- Insider recruitment is now an independent economic sector. On underground forums and in Telegram channels, brokers, trustees, and regular business partners are now operating as openly as in a regular industry.
- It's not about the most user rights but about the greatest decision-making power. Criminals are specifically looking for employees who can authorize payments, restore accounts, or bypass fraud checks—actions that an attacker could never credibly replicate from the outside.
- Insider services are becoming commoditized. Whether it's unlocked social media accounts, manipulated parcel tracking, or fraudulent discounts: There are now fixed prices, guaranteed processing times, and even reseller programs for all of this.
- The AI sector is moving into focus. The more valuable model data, training material, and privileged accesses AI companies accumulate, the more attractive their employees become for criminals.
"For a long time, we thought of insider threats primarily in terms of disgruntled employees or human error. What we are observing today is something fundamentally different: Criminals are specifically recruiting trustworthy employees through organized underground marketplaces and are turning insider access into a service that can be bought and sold," says Mayra Rosario Fuentes, Senior Threat Researcher at TrendAI.
The report examines this phenomenon across industries—from government, healthcare, social media, telecommunications, and finance to industry and energy, logistics, retail, and review platforms. How far professionalism has already progressed is particularly evident in three sectors: telecommunications, social media, and finance. Here, the report documents the most concrete case studies with credible figures—some even leading to criminal prosecution.
- Telecommunications: SIM-swapping as the most lucrative business
A bribed employee can bypass SMS-based two-factor authentication through SIM-swapping and thereby open the door for attackers to bank and cryptocurrency accounts. In the underground, this costs up to $20,000 at Verizon, T-Mobile, or AT&T plus 20% profit participation. Law enforcement agencies are already responding, as shown by a case in the USA: In November 2025, the Manhattan District Attorney indicted a SIM-swapping ring that allegedly stole around $435,000 from four victims with bribed AT&T and T-Mobile employees.
- Social Media: Locked accounts unlocked for cash
Insiders reactivate locked accounts on Meta, TikTok, or X for $1,000 to over $7,000 or approve fraudulent ads. Abuse of the internal tool "Oops" by bribed employees at Meta led to dismissals or other disciplinary action against more than two dozen employees and contractors at the end of 2022. Meta subsequently sued the alleged intermediaries in a Canadian court in 2023.
- Finance: The key to a bank account
In an underground forum, a seller offered three years of insider access to the accounting of a company with $25 million in annual sales, starting bid: $25,000. Clients paid up to $5,000 bounty or alternatively 15% of the proceeds for mediating a single bribed employee at crypto exchanges like Binance or Robinhood.
The complete report “The Market for Trust: How Cybercriminals Recruit Corporate Insiders” is available here: https://www.trendaisecurity.com/en/resources-insights/deep-research/what-cybercriminals-look-for-in-corporate-insiders.
TrendAI™ Press Office
c/o BRAND AFFAIRS AG
Mischa Keller / MSc Business Administration Partner Phone: +41 44 254 80 00 E-Mail: trendmicro-media@brandaffairs.ch Mühlebachstrasse 8 / 8008 Zurich / Switzerland