Cybercrime goes subscription: AI, malware and infrastructure on demand

Cybercrime goes subscription: AI, malware and infrastructure on demand Cybercrime has become a commercialized ecosystem where criminals can buy or rent nearly every capability needed to launch sophisticated attacks. These services provide anonymity, plausible deniability, and access to short-lived infrastructure that is difficult to detect, attribute, and disrupt, enabling low-skilled actors to operate at scale, according to the Infoblox 2026 Threat Landscape Report. “Cybercrime is becoming more efficient, automated, and harder to stop. Driven by economics and fueled in part by frontier AI, it has reached an unprecedented scale. The line between financially motivated and state actors has blurred in a complex economy that allows criminals to evade disruption through segmentation and the adoption of commodity services,” said Dr. Renee Burton, Head of Infoblox Threat Intel. Cybercrime becomes more industrialized The cybercrime ecosystem continues to expand and specialize as profits attract more participants, allowing attackers to evolve faster than defenders. AI is automating reconnaissance, generating convincing lures, and increasing the speed and scale of attacks. Executives and other high-profile individuals are vulnerable because threat actors exploit their identities in impersonation fraud, business email compromise, and social engineering schemes. Service providers and telecommunications companies are also exposed as criminals abuse their platforms and infrastructure to facilitate attacks. Screenshots of samples of targeted lure pages distributing the malware, impersonating entities (Source: Infoblox) Cybercrime services include marketplaces for pig-butchering operators, AI-generated lures, Android banking trojans, and infrastructure supporting illicit gambling operations. In one Android banking-trojan attack chain, criminals capture one-time passwords, device fingerprints, contacts, and facial biometrics, allowing them to steal entire digital identities and sustain account compromise and fraud. DCloud-based scam campaigns include fake cryptocurrency exchanges, pig-butchering schemes, phishing sites, wallet drainers, gambling portals, and fraudulent investment platforms. These campaigns primarily target consumers and can expose enterprise networks when employees encounter scam links during personal browsing on corporate or personal devices. Hidden infrastructure enables attacks To evade detection, attackers rely on trusted-looking and concealed infrastructure. They profile visitors by device, location, and behavior, delivering scams or malware only to intended targets and showing harmless content to others, including security researchers and automated scanners. Cloaking and traffic distribution systems hide malicious activity behind trusted advertising domains and redirect chains, reducing visibility into malicious campaigns. Bulletproof hosting providers support cybercriminal operations by prioritizing anonymity, ignoring abuse reports, and enabling rapid infrastructure migration. This allows phishing, fraud, malware, and other illicit activity to persist. Threat actors abuse trusted infrastructure because it increases success rates, reduces costs, conceals activity, improves resilience, and can provide access to users or networks that would otherwise be difficult to reach. Fake CAPTCHA scams trick mobile users into sending expensive international text messages through fraudulent human-verification pages. In one observed case, a single interaction generated about 60 messages and cost the victim about $30. The operation combined social engineering with automated infrastructure to generate revenue at scale. Brand impersonation and fraud put organizations at risk through their customers. Once customer credentials and personally identifiable information are leaked into the criminal ecosystem, attackers may reuse the data to extort organizations, develop new lures, and stage further attacks. Criminals create phishing pages that closely resemble legitimate websites. They replicate branding, logos, and user experiences instead of relying only on domains containing the impersonated company’s name. Selective targeting leaves fewer traces, making campaigns more difficult for security teams, email providers, and researchers to identify. Threat actors exploit the widespread use of smartphones for work and personal activities by developing personalized lures that appear relevant and trustworthy. Short-lived campaigns help attackers evade blocklists and detection by rotating domains, hosting providers, and URLs. Some phishing pages remain active for less than 24 hours, reducing the window for investigation. Expanding attack surface New technologies and expanding attack surfaces create security gaps before organizations establish monitoring and protection. Security teams must identify ownership, collect data, build detections, update policies, and train staff, giving attackers time to exploit those gaps. Residential proxy services route internet traffic through everyday devices such as phones, laptops, and smart TVs. This makes malicious activity appear to originate from legitimate residential IP addresses, making it more difficult to block and attribute malicious traffic. Residential proxies are often embedded in mobile applications and software development kits. Organizations may not realize that employee devices have become proxy endpoints, and the resulting traffic can appear to be legitimate application activity. Browser push-notification schemes trick users into clicking “Allow” through fake CAPTCHAs, cookie banners, and verification prompts. Once permission is granted, attackers gain a persistent communication channel to the victim’s device. Some victims received more than 140 notifications per day promoting investment scams, gambling sites, fake antivirus alerts, government impersonation scams, and other fraudulent content. Organizations need to update DNS records as cloud infrastructure changes. Some CNAME records remain after cloud services or hostnames are removed. Attackers can claim abandoned cloud resources, including Azure Web Apps and GitHub Pages sites using the same hostname, and take over trusted subdomains. During the Infoblox EASM early access program, one-third of identified dangling CNAMEs were easy or trivial to take over. Attackers can then use those subdomains for phishing, malware delivery, or other malicious activity. Threat actors are targeting software supply chains to reach large numbers of victims through trusted software, libraries, and development tools. In 2026, TeamPCP compromised Trivy, KICS, LiteLLM, and the Telnyx Python SDK. Access to software used by developers and security teams created opportunities to steal credentials and spread malicious code through downstream environments.