- Flashpoint found ~34 insider threat posts daily on dark web between July 2025–26
- July 2026 saw 12,653 posts, with 75% from insiders selling access themselves
- Report warns insiders are now the weakest link, urging external monitoring of illicit forums
Every month, hundreds of people try to sell access to their employer’s IT infrastructure on the dark web. Some do it for the money. Others do it because they’re angry with their company for whatever reason.
As a result, malicious insiders are growing into one of the biggest, most dangerous threats for modern businesses, experts have warned.
This is according to cybersecurity professionals Flashpoint which published its latest monthly analysis of insider threat recruitment, illicit access advertising, and threat actor activity targeting enterprise environments.
Employees selling, hackers buying
As per the report, between July 2025 and July 2026, there were an average of 34 unique posts on the dark web, every day, which can be classified as “insider threat posts”.
That is roughly a thousand unique posts every month. In July this year alone, Flashpoint analysts identified a total of 12,653 insider posts, including both threat actors attempting to recruit insiders in target organizations, and insiders advertising their services. Of these communications, 1,132 were unique posts.
“As perimeter security, EDR coverage, and other security tools mature, threat actors are finding it faster—and cheaper—to target the human element and simply buy an insider’s credentials or pay an employee to open the front door,” Flashpoint said. “In a threat landscape where identity is becoming the primary attack surface, monitoring illicit marketplaces and recruitment efforts is critical.”
Perhaps the best example is the 2025 Coinbase attack, when hackers bribed overseas customer support employees to provide access to customer data. Coinbase said at the time that the insiders abused legitimate system access, causing a cyber-incident that ended up costing the company around $360 million.
Over the course of the year, the biggest targets were organizations in three industries: telecommunications, retail, and finance. However, July 2026 findings “noticeably deviate from this trend”, Flashpoint said, finding that more than half (58.6%) of all posts affect other industries.
The researchers were still hedging, though, saying that this could also just be a way for threat actors to find an alternative entry point into the target network. Preparations for a supply-chain attack, essentially.
This communication goes both ways, Flashpoint noted. Sometimes it is the criminals offering money for passwords/access, and sometimes it is the insiders advertising their services to the wider cybercriminal community. However, the scales are heavily tilted towards the latter. Just in July this year, more than three quarters (75%) of all unique threat actor posts came from insiders.
“This indicates a highly motivated internal threat landscape where disgruntled employees actively seek out buyers for corporate data and network entry points,” Flashpoint concluded.
Changing the behavior
This report can be both good news, and bad news, depending on the context. It means that software has gotten so good that cybercriminals are moving away from “cracking” it and towards targeting employees who are now the weakest link in the cybersecurity chain.
The bad news is that organizations need to rethink how they defend their perimeter and that they have quite a difficult task at hand:
“Insider threats are inherently difficult to detect using internal security controls alone because the malicious activity relies on valid credentials and legitimate access privileges,” Flashpoint explains. “Relying solely on internal logs means security teams often only detect an insider threat after data exfiltration or system sabotage has already occurred.”
Instead, organizations should monitor deep and dark web forums, invite-only threat communities, as well as encrypted chat platforms, to spot when someone is trying to buy or sell access to their IT infrastructure. They should also keep an eye on infostealer activity, compromised corporate credentials, as well as active session tokens, and make sure they are not used against them.
Finally, they should deploy third-party cybersecurity intelligence that equips teams with adversary TTPs.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.
