The EU’s Internet Organized Crime Threat Report (IOCTA), issued in April 2026, describes how dark web forums continue to shape the underground economy; providing operational infrastructure, services, and anonymity while adapting against efforts to discover and dimantle them.
That said, general-purpose criminal marketplaces have shown signs of contraction due to actions by international law enforcement authorities. After takedowns, users migrate to other marketplaces which no longer have enough time to build up large user numbers.
In their place, smaller, dedicated platforms continued to gain traction. They focus on mediating tools and services for fraud (bank accounts, one-time password (OTP) bypass tools, compromised card data), access brokerage (compromised RDP/VPN credentials), malware services (stealers, droppers, loaders), etc. Smaller communities improve the operational security of the platform by limiting exposure and enable administrators to vet or restrict memberships.
Online fraud grows ever more sophisticated
Online fraud scheme (OFS) networks operate as highly efficient, transnational industries, utilizing a range of logistical, technical, and financial operations to perpetrate large-scale fraud. Phishing, the use of SIM boxes, and malicious advertising are common tactics used to steal funds and personal information. With the increasing adoption of generative AI, fraudsters can now personalise social engineering techniques, making them more convincing and dangerous.
The use of crime-as-a-service (CaaS), where fraudsters can outsource criminal activities like cryptocurrency theft, further expands the reach of online fraud. As AI tools become more sophisticated but also mainstream, the threat posed by OFS is set to further escalate, with automated processes enhancing the speed and scale of victimisation.
Residential proxies a vector
Residential proxies help camouflage criminal activity as legitimate traffic, making it harder for law enforcement to detect, track and attribute malicious traffic routed through home-user IPs in different countries.
Residential proxies act as intermediary servers, with an IP-address assigned to an internet-connected home device. They are widely available and marketed as a way to bypass geo-block or verifications, but these connections can be hijacked or rented by cybercriminals and used to disguise malicious traffic, launch DDoS attacks or scrape data.
Residential proxies can become compromised through vulnerabilities in the unpatched and/or unsecured home appliances or by installing malicious applications that grant access to the device
Sophisticated techniques complicate detection
The resilience and adaptability of dark web marketplaces and forums, coupled with the use of cryptocurrencies, further complicate the efforts of policing in the digital domain. The current online fraud epidemic, the threat posed by ransomware intertwining with hybrid threats, and the monetisation of child sexual abuse material underscore the urgent need for more proactive and collaborative efforts.
Cybercriminals rely on ‘Bullet Proof Hosting’ providers which resist or ignore takedown requests and interventions by law enforcement. This creates resilience for their backend infrastructure. These services, sometimes embedded within multi-layered leasing arrangements (sub- sub-leasing) are nested across several jurisdictions, systematically disregarding abuse notifications and judicial takedown requests.
Also, the widespread use of end-to-end encryption platforms and complex jurisdictional barriers create significant investigative challenges, hindering the identification of suspects and the corroboration of evidence. Restrictive data retention policies also leave law enforcement authorities unable to access crucial data in a timely manner, further impeding their ability to track suspects and disrupt criminal operations.
AI makes it worse
The rapid evolution and accessibility of a wide range of AI tools continuously create opportunities for the whole cybercrime ecosystem to increase efficiency,speed and reach. Criminal networks involved in cybercrime adeptly harness AI and automation to upscale their operations, facilitated by the parallel integration of AI capabilities in legitimate security contexts and business applications, which opens further avenues for exploitation.
The dark web remains an important hub for malicious large language models (LLMs), which are built or adapted to remove ethical constraints and filters fromlegitimate commercial solutions. AI models can also be tailored for criminal purposes by providing inputs that are most relevant and accurate for that application.
Additional risks
While it does not explicitly focus on media piracy, the report details resources and techniques that are used extensively by pirates. These include the criminal infrastructure behind online fraud schemes, cyberattacks, developments in the ransomware ecosystem, new hacking coalitions that threaten platform provider and consumer data, infostealers, DDoS attacks, and the exploitation of these tools for sexual exploitation.
Why it matters
The accelerating pace of cybercrime presents progressively sophisticated threats to society, with harmful implications both online and offline.
Cybercriminals are rapidly exploiting advanced technologies, particularly AI tools, to enhance the speed, efficiency, and scope of their illicit activities. These tools not only enable automation in criminal processes but also blur the lines between legitimate and malicious uses of technology.
Europol characterizes the Internet Organised Crime Threat Assessment (IOCTA) 2026 as the most comprehensive analysis of the latest threats and trends in cybercrime in the EU and as a call to action for all stakeholders committed to safeguarding society in the digital domain and beyond.
Further reading
The evolving threat landscape. How encryption, proxies and AI are expanding cybercrime – Internet Organised Crime Threat Assessment (IOCTA) 2026. Landing page. April 2026. Publications Office of the European Union, Luxembourg
Europol: 2025 cybercrime threat assessment exposes black market ecosystem for stolen data. Article. June 12, 2025. by Steven Hawley. Piracy Monitor
