2024 threat forecasts show fraud farms and phishing scaling fast

At a glance

What this is: Arkose Labs’ threat forecast argues that evolved phishing, SMS toll fraud and cybercrime-as-a-service will scale quickly in 2024, with a cited 121% rise in total cyberattacks in Q2 over Q1 2023.

Why it matters: IAM and fraud teams need to treat these tactics as identity and access problems, not just awareness problems, because they target authentication flows, account recovery and the trust decisions around digital interactions.

By the numbers:

• The article cites a 121% increase in total cyberattacks in Q2 over Q1 2023.
• Arkose Labs says SMS toll fraud increased by 141% in Q3 2023.
• The article projects a 20-fold increase in the prevalence of cybercrime-as-a-service in 2024.

Context

Phishing, SMS toll fraud and cybercrime-as-a-service are not isolated nuisances. They are industrial fraud channels that target identity trust, session initiation and recovery workflows, which makes them directly relevant to IAM, fraud operations and account protection programmes.

Arkose Labs frames 2024 as a year in which attackers will use bots, human fraud farms and social engineering more systematically. For security teams, the governance problem is that these attacks blend technical abuse with human manipulation, so controls focused only on training or perimeter filtering leave critical gaps.

The article’s central message is that fraud scaling is now a programme-level issue rather than a point-in-time campaign. That is typical of broader threat-market industrialisation, where attackers treat account compromise and monetisation as repeatable services.

Key questions

Q: What breaks when adversary-in-the-middle phishing is used against login flows?

A: The trust model breaks because the user appears to authenticate to the real service, while the attacker sits between the user and the target in real time. That allows credential relay, token capture and session replay. Teams should assume that anything relying on visual site recognition alone is fragile when the session itself can be proxied.

Q: Why does SMS toll fraud create IAM risk as well as financial risk?

A: SMS toll fraud turns an identity control channel into a monetisation channel. If login, recovery, or verification relies too heavily on SMS, attackers can abuse that path to drive costs, weaken trust, or redirect users. That makes SMS dependency a governance issue, not just a telecom or billing issue.

Q: How should security teams reduce account takeover from bot-driven attacks?

A: Security teams should harden the most abuse-prone flows first: login, recovery, device enrolment, and payment-related actions. Use step-up verification for risky events, reduce credential reuse, and monitor for automation patterns across sessions. The goal is not only to block bots, but to make account abuse expensive and noisy enough to fail.

Q: What does the rise of cybercrime-as-a-service mean for identity programmes?

A: It means attackers can scale abuse without building the tooling themselves, so fraud and account takeover should be planned as repeatable industrial processes. Identity programmes need controls that reduce throughput across login, recovery and signup flows, because service-based attackers will test those paths continuously.

Technical breakdown

Adversary-in-the-middle phishing and reverse proxy control

Adversary-in-the-middle phishing uses a live proxy between the user and the legitimate service, so credentials, session tokens and second-factor prompts can be intercepted in real time. Unlike static phishing pages, this pattern preserves the look and feel of the target site while silently relaying traffic to the attacker. That makes the attack particularly effective against users who rely on visual cues alone. The real danger is not only credential theft, but session hijack after successful authentication. Practical implication: authenticate on context, not appearance, and treat token theft and replay resistance as core control requirements.

Practical implication: strengthen phishing-resistant authentication and session binding so stolen credentials do not become reusable sessions.

SMS toll fraud as an abuse of trust and routing economics

SMS toll fraud, also called SMS pumping, exploits systems that send one-time codes or verification messages by generating large volumes of messages to numbers or routes that benefit the attacker economically. The attacker is not trying to break encryption; they are exploiting the messaging workflow, carrier relationships and billing model. Because the traffic can look like ordinary verification activity, it may evade standard abuse detection until losses accumulate. This is why SMS-based controls should be treated as fraud surfaces, not just delivery channels. Practical implication: instrument message velocity, destination patterns and abuse thresholds as part of the identity control stack.

Practical implication: monitor SMS verification flows for abnormal volume and route abuse before costs and fraud losses escalate.

Cybercrime-as-a-service turns fraud into a managed supply chain

Cybercrime-as-a-service professionalises abuse by packaging bots, access, training and support into a repeatable criminal service. That changes the defender’s problem from one-off adversaries to a scalable ecosystem with predictable onboarding, tooling and monetisation. When attackers can buy capability instead of building it, fraud volume becomes more elastic and less dependent on technical skill. This also lowers the barrier for campaigns that target identity workflows at scale, including signup abuse, account takeover and automated credential attacks. Practical implication: measure whether your fraud controls can absorb industrial-scale replay, automation and delegation.

Practical implication: design controls for repeatable abuse at scale, not just isolated attacker techniques.

Threat narrative

Attacker objective: The attacker aims to monetise trusted digital interactions by stealing sessions, draining financial accounts and scaling fraudulent access through industrialised services.

1. Entry begins with adversary-in-the-middle phishing, where the victim is lured through a redirect or proxy that mirrors a legitimate login flow.
2. Credential capture or abuse occurs when the attacker relays or harvests login material and session artefacts in transit, allowing replay into the target environment.
3. Impact follows when the attacker uses the stolen trust relationship to drain accounts, steal payment data or monetize access through fraud operations.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing is no longer just a message problem, it is a trust-path problem. When attackers proxy the login journey in real time, the control failure is not user gullibility alone but the assumption that the visible site is the trusted site. That assumption breaks as soon as the attacker can sit in the middle of the session. Practitioners should treat phishing-resistant assurance and session integrity as one control surface, not two separate teams.

SMS verification has become a fraud cost centre, not a simple delivery channel. Once verification traffic can be manipulated for toll fraud, the security programme is dealing with abuse economics as much as authentication. This is why message routing, volume anomalies and destination abuse belong in governance discussions, not just telecom operations. Teams that only watch for message delivery success will miss the economic abuse pattern entirely.

Cybercrime-as-a-service is the industrialisation of identity abuse. The market signal here is that attackers are buying execution capacity in the same way defenders buy services, which makes scaling fraud easier and attribution harder. That shifts the governance challenge from blocking a single technique to reducing the repeatability of abuse across signup, login and recovery flows. The practical conclusion is to build controls that degrade attacker throughput, not only detect suspicious events.

Identity and fraud programmes are converging around one operating model. Account takeover, phishing and SMS abuse all exploit the same underlying trust decision: whether a request or session should be treated as legitimate. That means IAM, fraud operations and security architecture need shared telemetry and shared response logic. The implication is straightforward: separate control towers for identity and fraud leave attackers a gap between teams.

Industrial fraud needs industrial response. A 20-fold rise in CaaS is not a tactical uptick, it is a signal that criminal tooling and service models are maturing. Defenders should expect higher volume, lower skill barriers for attackers and faster campaign turnover. The field should now measure how quickly controls reduce attacker scale, not only how well they detect individual attempts.

What this signals

Identity teams should assume fraud has become a supply-chain problem. When criminals can buy bots, training and support as a service, the defender’s unit of analysis changes from an individual campaign to a reusable abuse model. That means controls must be evaluated on how much attacker throughput they reduce across login, recovery and payment flows.

Evolved phishing and SMS fraud expose the limits of awareness-led defence. User training still matters, but it cannot compensate for live proxy attacks or billing-model abuse. The operational question is whether your authentication and recovery flows remain trustworthy when the attacker controls the interaction path or the economics of the message channel.

For practitioners

• Tighten phishing-resistant authentication Move high-risk user journeys toward phishing-resistant methods and bind sessions more tightly to the authenticated context so a proxy cannot replay trust downstream.
• Instrument verification-flow abuse Track SMS and one-time-code traffic by destination, route and velocity so fraud teams can spot pumping patterns before billing spikes or verification abuse spreads.
• Harden account recovery paths Review recovery, reset and step-up flows for proxyable steps that can be abused when an attacker controls the interaction path rather than the endpoint.
• Correlate identity and fraud telemetry Unify login, recovery, message-delivery and bot signals so the programme can see coordinated abuse across teams instead of isolated events.
• Stress-test controls against industrial abuse Run scenarios where bot volume, fraud-farm traffic and replayed sessions arrive at scale to measure whether current controls slow attacker throughput or merely alert on it.

Key takeaways

• The article describes a move toward industrialised fraud, where phishing, SMS abuse and service-based criminal tooling reinforce one another.
• The cited threat signals include a 121% rise in total cyberattacks in Q2 over Q1 2023, a 141% increase in SMS toll fraud in Q3 2023 and a projected 20-fold rise in CaaS.
• The practical response is to harden identity journeys, instrument abuse economics and measure whether controls reduce attacker scale rather than only detecting individual events.

Key terms

• Adversary-in-the-middle phishing: A phishing method that places an attacker between the user and the real identity provider so the attacker can intercept or relay the authenticated session. It often preserves the user experience, which is why it can evade awareness and some detection paths while still producing usable session tokens.
• SMS Toll Fraud: SMS toll fraud is the abuse of authentication or verification flows to generate revenue from premium-rate or otherwise monetised message delivery. The attacker does not need to steal accounts or payments. The platform’s own identity traffic becomes the mechanism that produces loss.
• Cybercrime-as-a-Service: Cybercrime-as-a-service is a criminal operating model where tools, infrastructure or attack services are rented or outsourced. It lowers the technical barrier for attackers and increases the speed, consistency and scale of fraud and credential attacks.
• Session Replay: A technique where an attacker reuses a captured authenticated session token to act as the victim without knowing the password. In modern cloud environments, replay can bypass traditional login controls and persist until the token is revoked or naturally expires.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.