Criminal Recruiters Want People on Your Payroll
Help Net Security, Friday, October 2nd, 2026
Research on underground forums shows criminals recruiting insiders to sell account resets, lookups, SIM swaps and shipment changes.
An Intel 471 report analyzing 85 underground records found recruitment of employees was the most common activity, followed by claims of insider access and advertised insider-enabled services.
Criminals sought staff who could retrieve restricted data, manipulate accounts, facilitate SIM swaps, interfere with shipments or support fraud and extortion, paid brokers to find suitable personnel, and frequently named logistics, telecom, social media and financial firms.
The findings show how routine employee privileges can be turned into services that bypass external security controls.