'The easiest way into a company isn't always through a vulnerability anymore': Hackers are building a global insider threat recruitment network – and they’re even offering referral bonuses

Cyber criminal gangs are upping their game when it comes to recruiting corporate insiders to support attacks and leak sensitive data.

That’s according to a new report from TrendAI, part of Trend Micro. Analysis from the firm has uncovered a “highly structured underground economy” powered by Telegram and hacking forums.

Complete with brokers, escrow services, and recruitment posts, this criminal network links corporate employees willing to sell secrets to fraudsters, scammers, and ransomware groups.

Researchers warned the market for recruiting corporate insiders is one of the fastest growing but least understood risks to enterprise security in 2026.

"The easiest way into a company isn't always through a vulnerability anymore," said David Sancho, senior threat researcher at TrendAI. "Sometimes it's through an employee."

Insider threats have been rising in recent years. A report from Cifas earlier this year suggested that one-in-eight Brits have sold company logins, or know someone who has.

Two-way fraud

Insider threats work both ways, according to TrendAI. Some of the time, dodgy employees post listings offering access and other key data, but criminals are also actively soliciting people working at target companies.

That can include access for pay, but also compromising authentication, monitoring, and approval workflows internally, the report noted.

Insiders may be offered a fixed payment or a profit-sharing agreement, and some criminals will pay a referral bonus, too, the report noted.

Workers rarely join a company with the intention of selling out their employer, the report noted, but said they can be persuaded to act on behalf of a threat actor over time.

"This shift may be driven by changes in workplace culture, personal financial pressures, or a general dissatisfaction with their circumstances," the report noted. "This human vulnerability is precisely what the underground market for insider access is built to exploit."

Wide range of industries targeted

One target is social media companies, with criminals seeking insiders who will safelist dodgy ads, assist with account takeover, or remove account bans, with prices for the latter running from $1,000 to $7,000 shares.

Similar tactics are used on review platforms to delete negative comments, inflate ratings, and approve fraudulent refunds.

Telecommunications firms are also being targeted, with efforts focused on SIM swaps to allow hackers to break SMS-based multi factor authentication (MFA) to access email or bank accounts.

More traditional companies are also at risk from insider recruitment by hackers, particularly in areas such as financial services and shipping and logistics.

Employees in these industries are a key target for threat actors, the report noted, largely due to their ability to approve transfers, generate shipping labels, or falsify delivery confirmations.

"One buyer offered $1,000 per day for a FedEx employee capable of uploading tracking information into internal systems," the report noted. "Beyond selling data or single actions, insiders increasingly sell standing access to entire systems, collapsing a full intrusion into a single purchase.”

"Listings range from a few hundred dollars for credentials to a government-linked platform, up to premium offers of administrator-level control inside large enterprises."

What can be done?

Companies should prepare staff for the possibility they may be approached by criminals, but also prepare systems to spot odd behavior in case an insider does sell out their employer

"The underground is increasingly treating trusted access as a commodity, openly recruiting insiders who can bypass security simply by doing their jobs," Sancho said. "Defending against insider threats now means recognizing that your employees are targets too."

Beyond that, TrendAI advised monitoring workflow exceptions as though they are security events, such as excessive account recoveries or the timing of manual approvals, and reducing single-person authority by requiring dual approval for high-risk transactions.

Fraud and cybersecurity teams should share information and work together to avoid such attacks slipping between the cracks, they added.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.