Hackers Recruit Insiders With Cash and Referrals

How the recruitment scheme works

A TrendAI (Trend Micro) report describes a structured underground market operating largely on Telegram and hacking forums, where criminals recruit employees willing to sell access, approve fraudulent transactions, or bypass internal controls. The market includes brokers, escrow services, and recruitment posts that connect insiders with buyers ranging from scammers to ransomware groups. Recruitment runs in both directions: insiders advertise their access for sale, and criminals also actively solicit employees at target companies.

What insiders are paid to do

The report lists specific examples of paid insider actions across several industries:

• Uploading falsified tracking information into shipping systems, with one buyer reportedly offering $1,000 per day for a FedEx employee capable of doing this
• Performing SIM swaps at telecom companies to defeat SMS-based multi-factor authentication and gain access to email or bank accounts
• Removing account bans or safelisting suspicious ads on social media platforms, with prices for ban removal reportedly ranging from $1,000 to $7,000
• Approving fraudulent refunds or transfers, generating shipping labels, or falsifying delivery confirmations

Offers to insiders include fixed payments, profit-sharing agreements, and referral bonuses for bringing in additional insiders.

Why this approach succeeds

This type of recruitment does not rely on exploiting a technical vulnerability. Instead, it targets employees who already have legitimate access to internal systems, approval workflows, or moderation tools. Because the requested actions, such as approving a transfer or updating a tracking record, can resemble routine job tasks, they may not immediately stand out as suspicious to the insider or to observers, especially when payment is framed as a simple side gig.

What to watch for

Defenders and employees should be alert to:

• Unsolicited approaches on messaging apps like Telegram offering payment for internal actions
• Offers of unusually high pay, profit-sharing, or referral bonuses tied to job-related access
• Requests to bypass verification steps, approval workflows, or moderation policies
• Unusual workflow exceptions, such as excessive account recoveries or oddly timed manual approvals

Building resistance

TrendAI recommends treating workflow exceptions as security events worth reviewing, and reducing single-person authority by requiring dual approval for high-risk transactions such as transfers, account recoveries, and moderation overrides. The report also recommends that fraud and cybersecurity teams share information and coordinate, since these schemes blend policy abuse with technical compromise and can otherwise slip between the cracks. Preparing staff across shipping, telecom, finance, and trust and safety roles to recognize and report recruitment attempts is a key part of reducing this exposure.

How are criminals recruiting corporate insiders?

According to a TrendAI report, criminals use Telegram and hacking forums to run a structured underground economy with brokers, escrow services, and recruitment posts that connect insiders to buyers, including scammers and ransomware groups.

What kinds of payments do insiders receive?

Offers include fixed payments, profit-sharing agreements, and referral bonuses, with one example describing $1,000 per day offered for a FedEx employee capable of uploading tracking information into internal systems.

Which industries and roles are being targeted?

Targeted roles span shipping and logistics, telecommunications customer service, financial approvals, and social media trust and safety teams, since these roles can bypass verification, approvals, or moderation controls.

How can organizations reduce this risk?

TrendAI recommends monitoring workflow exceptions as security events, requiring dual approval for high-risk transactions, and having fraud and security teams share information so these schemes do not slip between the cracks.