Loading story…
Cybercriminals are increasingly targeting employees within banks, telecommunications companies, and technology firms, offering substantial payments in exchange for insider access to sensitive systems and data. Recent research by Check Point highlights that these recruitment efforts are conducted via darknet forums, with payouts ranging from $3,000 to $15,000 for one-time access or specific information, and even higher for particularly valuable data such as large cryptocurrency exchange records. The campaigns specifically name high-profile organizations, including major banks, cryptocurrency exchanges like Coinbase and Binance, and tech giants such as Apple and Samsung, as well as cloud service providers and consulting firms. Insiders are being solicited to provide network access, leak credentials, disable security defenses, or facilitate attacks such as SIM-swapping, which can be used to bypass two-factor authentication.
The recruitment tactics often employ emotional manipulation, promising financial freedom and long-term arrangements, with some offers including weekly payments for ongoing cooperation. The financial sector remains a primary target due to the direct access to funds and customer data, but the threat extends to other industries, including telecommunications and technology, where employees can enable attacks on infrastructure and user accounts. These developments present a significant security challenge, as insider threats are more difficult to detect and mitigate compared to external attacks, and highlight the need for organizations to strengthen internal monitoring and employee awareness programs.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Check Point Research reported a growing trend of threat actors recruiting employees inside banks, telecoms, technology firms, cryptocurrency exchanges, and government entities to provide access or sensitive data. The activity was described as taking place through darknet forums and encrypted channels such as Telegram, with payments ranging from thousands of dollars to, in some cases, six figures.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizations are facing a growing risk from insider threats, as cybercriminals increasingly exploit both the hiring process and employee online behavior to gain unauthorized access to sensitive data. Attackers are now impersonating cybersecurity and IT professionals, using fabricated resumes, deepfake technology, and stolen identities to secure legitimate positions within companies. Once inside, these "fake workers" can access confidential databases and systems, often leveraging remote work vulnerabilities and sophisticated obfuscation techniques such as VPNs and proxy servers to mask their true origins. At the same time, employees' tendency to overshare on professional and social platforms like LinkedIn, GitHub, and X provides threat actors with valuable intelligence. Publicly available information about job roles, internal relationships, technical stacks, and even travel plans can be weaponized for spearphishing, business email compromise, and other targeted attacks. The combination of lax vetting in remote hiring and excessive online disclosure significantly increases the attack surface, making it easier for adversaries to infiltrate organizations and execute sophisticated social engineering campaigns.
Jun 29, 2026
A group of outsourced staff at Ubisoft were bribed by cybercriminals, leading to the compromise and sale of the company's most valuable intellectual property. This incident highlights the growing risk of insider threats, particularly when external contractors are targeted by threat actors seeking privileged access to sensitive assets. The breach underscores the importance of robust vetting and monitoring of third-party personnel, as well as the need for strong internal controls to detect and prevent insider collusion. In a related trend, cybersecurity professionals themselves have admitted to acting as affiliates for the BlackCat ransomware group, leveraging their technical expertise to facilitate attacks. These revelations demonstrate the increasing willingness of individuals with legitimate access and skills to collaborate with cybercriminal organizations, either for financial gain or under coercion. The convergence of insider threats and professional expertise within cybercrime operations poses a significant challenge for organizations seeking to defend against sophisticated, multi-vector attacks.
Jun 29, 2026
Cybercriminals are increasingly exploiting the job search process to launch sophisticated social engineering attacks aimed at stealing credentials and compromising systems. In one widespread campaign, attackers send phishing emails that masquerade as job offers for Social Media Manager positions, leveraging the reputations of well-known brands such as KFC, Ferrari, and Red Bull to build trust with potential victims. These emails are often sent from legitimate-looking services like Google Workspace and Microsoft 365, making them harder to detect. Victims who click on the provided links are redirected through a series of deceptive web pages, including fake security checks and fraudulent job postings designed to mimic reputable sites like Glassdoor. The process culminates in a fake Facebook login page, where users are tricked into entering their credentials, which are then harvested by the attackers. Sublime Security researchers have identified telltale signs of these scams, such as suspicious URLs that appear to be associated with trusted brands but are actually redirects to malicious sites. The attackers use templates or large language models to generate convincing, varied phishing messages at scale, increasing the reach and effectiveness of their campaign. In a separate but thematically similar attack, developers are targeted on LinkedIn by a fake recruiter claiming to represent an AI-driven company called DLMind. The recruiter, using a well-crafted persona and a polished LinkedIn profile, invites victims to access a private GitHub repository under the pretense of a coding assessment. When the victim runs the provided setup script, a multi-stage malware payload is executed. This malware is designed to scan for sensitive files, steal browser credentials and cookies, hijack clipboard data, collect system information, and establish persistent remote access using tools like AnyDesk. The attack chain is carefully engineered to blend into a developer’s normal workflow, making detection difficult. Both campaigns demonstrate a trend of attackers weaponizing trust and exploiting the job-seeking process, using a combination of social engineering and technical sophistication to achieve their objectives. The impact of these attacks includes the theft of social media credentials, exposure of sensitive personal and professional data, and the potential for long-term system compromise. Security researchers emphasize the importance of vigilance when responding to unsolicited job offers, especially those that require logging in through unfamiliar portals or running code from unverified sources. Organizations are advised to educate employees about these tactics and implement technical controls to detect and block such phishing and malware delivery attempts. The use of legitimate platforms and convincing personas by attackers underscores the need for robust verification processes and heightened awareness among job seekers and professionals alike. These incidents highlight the evolving nature of social engineering threats and the critical importance of multi-layered defense strategies. The campaigns also illustrate how attackers are leveraging automation and AI to scale their operations and increase the sophistication of their lures. As the job market remains competitive, individuals and organizations must remain alert to the risks posed by these targeted attacks. Ongoing monitoring, user education, and rapid incident response are essential to mitigating the impact of such credential theft and system compromise campaigns.
Jul 8, 2026