Insider Threat Report: Dark Web Recruitment & Access Trends

Unknowingly, a member of key personnel is living two separate lives. On the clock, they are a highly-trusted systems administrator, but in their personal time, they moonlight on the deep and dark web, advertising their trust and access to the highest bidder. One day, they get a simple offer: $15,000 in the crypto of their choice to approve a single push notification at 2 AM. They accept. By morning, the attacker walks away with active domain admin credentials without the need for malware or cracking firewalls. This is just one example of how insider threats lead to modern enterprise breaches. This year, Flashpoint uncovered 7,282 unique insider threat posts, with an average of 34 unique posts being posted daily. As perimeter security, EDR coverage, and other security tools mature, threat actors are finding it faster—and cheaper—to target the human element and simply buy an insider’s credentials or pay an employee to open the front door. In a threat landscape where identity is becoming the primary attack surface, monitoring illicit marketplaces and recruitment efforts is critical. This new monthly report leverages Flashpoint’s Primary Source Collection (PSC) to analyze insider threat tactics, tracking active recruitment and advertising on dark web forums and encrypted networks. The Insider Threat Landscape: July 2026 In July 2026, Flashpoint analysts identified a total of 12,653 insider posts. These communications include both threat actors attempting to recruit insiders in target organizations, as well as insiders advertising their services on illicit forums and marketplaces. Of these total communications, Flashpoint observed 1,132 unique posts in July 2026. Where Insider Threat Activity is Concentrated Historically, the Telecommunications, Retail, and Financial industries are most adversely affected by insider threat activity. However, July 2026 findings noticeably deviate from this trend. Flashpoint found 58.6% of total insider threat posts affected “Other” industries—suggesting adversaries are diversifying their target base. Threat actors may be attempting to recruit within supply chain partners, logistic hubs, manufacturing platforms, and specialized service providers to find alternative entry points into target networks. The following table shows a breakdown of unique insider posts by industry in July 2026: | Industry | Posts | | Other | 663 | | Financial | 150 | | Retail | 112 | | Technology | 84 | | Telecom | 74 | | Public Sector | 43 | | Healthcare | 3 | | Media | 3 | | Total | 1,132 | Insider Threats: Recruiting vs. Advertising Active insider threats work in two ways: an insider is “recruited” by a malicious outside party, or a malicious insider “advertises” their access and skills to an interested threat actor. Regardless, by leveraging this connection, insiders assist adversaries by exfiltrating valuable data, installing malware, sabotaging IT systems, or performing SIM swaps. In July 2026, Flashpoint found that over 75% of unique threat actor posts came from insiders advertising their access to malicious third parties. This indicates a highly motivated internal threat landscape where disgruntled employees actively seek out buyers for corporate data and network entry points. Protect Against Insider Threats Using Flashpoint Insider threats are inherently difficult to detect using internal security controls alone because the malicious activity relies on valid credentials and legitimate access privileges. Relying solely on internal logs means security teams often only detect an insider threat after data exfiltration or system sabotage has already occurred. Flashpoint protects organizations against insider threats through our Primary Source Collection (PSC) and specialized intelligence platforms: - External Threat Intelligence & Early Warning: Flashpoint monitors deep and dark web forums, invite-only threat communities, and encrypted chat platforms to identify employee solicitations, stolen corporate domain mentions, and active recruitment attempts before an intrusion develops. - Identity Protection & Infostealer Tracking: By tracking illicit marketplaces and infostealer activity, Flashpoint identifies compromised corporate credentials and active session tokens, preventing threat actors from utilizing purchased access. - User & Entity Behavior Context: Flashpoint’s intelligence equips SOC, Security Operations, and Risk Management teams with adversary TTPs, enabling security operations to look for anomalous data downloads, off-hours access, or unauthorized software installation. To learn more about how Flashpoint can help protect your enterprise from insider risk and monitor illicit underground communities, Request a Demo Today. Frequently Asked Questions (FAQs) What is the Flashpoint Insider Threat Report? The Flashpoint Insider Threat Report is a monthly intelligence brief that analyzes trends, volume, targeted industries, and tactics surrounding insider threat recruitment and illicit access advertising on the deep web, dark web, and encrypted chat channels. How does Flashpoint collect insider threat data? Flashpoint collects data using its Primary Source Collection (PSC) engine, which actively monitors thousands of dark web forums, illicit marketplaces, and underground chat networks where threat actors and malicious insiders communicate. What is the difference between insider recruitment and insider advertising? Insider recruitment occurs when an external cybercriminal attempts to entice a corporate employee into assisting with a cyberattack. Insider advertising occurs when an employee or contractor proactively lists their legitimate access or services for sale on illicit marketplaces.