In March 2025, a contractor at a Brazilian company that connects financial institutions to Pix, the country’s instant payment system, was approached as he left a bar. A week later he got a phone call: 5,000 reais for his login and password. Later came another 10,000 reais to run, on his work computer, commands he received through a web page.
In July, the attack on C&M Software went public. According to the São Paulo Civil Police, 541 million reais left a single one of the affected institutions in fraudulent transfers, as SBT News reported on July 4, 2025. The access was real. The password was real. The machine belonged to the company.
No firewall stops that, because nothing about it looks like an attack. It is work, done by someone who is allowed to do it.
The question for anyone running a large fleet is not whether someone on the team could be approached. It is what the workstation would show if that happened.
Insider recruitment has become routine
The Brazilian case was not an outlier. A study by Intel 471, released in early October 2026, looked at how criminals recruit employees on forums and underground channels. It was summarized by Help Net Security on October 2, 2026.
Of the 85 records analyzed, 45 were recruitment posts, the largest category in the sample. Another 15 involved someone claiming to already have insider capability, and 12 advertised “services” carried out from inside a company.
The industries mentioned most often were transportation (19 leads), technology (17) and telecommunications (15). What the buyers want is mundane: look up a customer record, reset an account, approve a transaction, change a record.
The study itself warns that these numbers describe the sample, not how common the problem is in each industry. But they show the business model: criminals do not need to break in when they can rent someone who is already inside.
Why perimeter defense does not see it
Almost every layer of corporate network protection was designed to separate insiders from outsiders. Strong passwords, a second factor, VPN, segmentation. All of it works against someone trying to get in.
Against someone who is already in with their own credentials, each of those layers confirms the access instead of questioning it. The second factor is approved by the account owner. The VPN connects the right machine. The system logs an authorized user.
That is why a recruited insider is a workstation problem before it is a network problem. The behavior changes on the machine: the hours, the program that shows up, the privilege someone starts using, the data that leaves.
What tends to change on the workstation before the damage
No single signal proves anything. People work late for a thousand legitimate reasons. What matters is the combination, and the persistence.
Hours
Recurring use outside the agreed window, without approval, by someone who did not have that pattern. In the Brazilian case, the employee told police he had been entering commands into the system since May, months before the attack.
New software
A remote access tool installed without a ticket, a personal cloud client, a command-line utility nobody in that department uses. Software that was not in last month’s inventory.
Privilege
Someone who started working as a local administrator, or a program that began running with full rights for no business reason.
Data leaving the machine
Copies to a USB drive, uploads to an external storage service, an unusual export volume. And, above all, repeated attempts after a block: someone who keeps hitting the same rule is telling you something.
Written rules first, evidence after
Looking at this calls for care in two directions. The first is privacy law: measuring how people behave on their workstations is processing personal data. The rule has to be written down, have a clear purpose and be communicated to staff before it is switched on.
The second is the method. A risk score nobody can explain is useless in a conversation with HR and useless in a legal process. Every point has to trace back to the rule and the event that produced it.
Some practices cut exposure before any tool is involved:
- real least privilege, reviewed whenever someone changes roles;
- an operating window defined per group, with exceptions approved and recorded;
- a closed list of what can be installed on machines that touch critical systems;
- a channel where employees can report an approach without being treated as suspects.
If the worst happens, time works against you. Attackers stay inside networks for weeks before anyone notices, and workstation evidence has to last long enough to cover that dwell time. Remote access tools deserve separate attention: the support tool is also a door.
How Trauma Zer0 handles it
Tz0 Security enforces policy on the workstation itself, whether or not it can reach the server at the moment of the attempt. It defines what can run, what can be installed and what can leave the machine, by group, by department or by workstation. A USB drive that is not on the list does not mount, and the attempt is recorded with device, user and time.
Time control sets the window in which each group may operate and records what was attempted outside it. The privilege view shows who works as a local administrator and which programs run with full rights. The change view separates real software and hardware changes from Windows noise.
Behavior analysis gives each person a risk score, recalculated every night, and every point is explained by the rule and the event behind it. The tool does not judge intent. It points to the deviation so that someone in the company can assess it, under the rules the company wrote.
Each attempt becomes an event with a timestamp, machine and user, and the whole cycle runs inside the customer’s network: the evidence stays on the company’s own server. When a deeper investigation is needed, Tz0 Forensics handles collection and preservation.
Legitimate access needs rules too
Insider recruitment does not depend on a technical flaw. It depends on a person, a valid credential and a workstation where nobody looks at what changed.
A company cannot control who approaches its employees outside a bar. It can control what the machine allows, what it records and how long the evidence is kept.
If your security policy still treats every authenticated session as trusted, it is worth seeing what your fleet shows today. Request a Trauma Zer0 evaluation and apply the rule in your real environment.