“A Perfect Storm”: How AI, Malware and Trafficked Workers Have Industrialized the Global Scam Industry

Over the past several years, internet and telephone fraud have surged to unprecedented levels. According to the Global Anti-Scam Alliance, one in four adults worldwide lost money to scams last year, and 13% of people encountered attempted scams at least once a day. The U.N. calls the phenomenon a "scamdemic," with estimated global losses to online fraud exceeding $1 trillion annually.

The epicenter of much of this activity is Southeast Asia. An estimated 300,000 people from more than 65 countries have been trafficked into fortified scam compounds across Myanmar, Laos and Cambodia. From these so-called "scam prisons," victims are forced to run romance-investment cons, crypto frauds, money-laundering operations and illegal gambling schemes. A 2024 U.S. Institute of Peace estimate puts Cambodia’s annual online-fraud revenue at roughly $12.5 billion—about half of the country’s formal GDP.

From Long Cons to Cybercrime Factories

As law-enforcement pressure and public awareness have increased, scam operations known as "pig-butchering" have evolved from lengthy trust-based romance scams into highly professional and scalable enterprises. A recent report from California-based cybersecurity firm Infoblox documents a shift toward sophisticated remote access trojans (RATs) that operate like pervasive surveillance suites: monitoring messages, photos and notes; exfiltrating sensitive data; granting operators full control of victims’ devices; and installing additional malware after initial infection.

Infoblox has linked these trojans to attacks in at least 20 countries, from the Philippines and Morocco to Brazil, and warns that potentially millions of devices are vulnerable. Scammers impersonate trusted institutions—tax agencies, police, banks, airlines—and distribute falsified or modified apps that closely mimic official storefronts like Google Play to bypass security and drain accounts. Most targets so far run Android systems and are lured into installing APKs or fake app interfaces.

"You’ve had this professionalization of fraud," says Jeremy Douglas, deputy director of Operations at the UNODC. "This is the future of the scam business."

The AI Factor

Artificial intelligence is amplifying the problem in two major ways. First, AI can generate tailored scam scripts, convincingly fabricate photos or videos, and translate content into many languages, making cons more persuasive and allowing operations to scale quickly. Second, AI-driven shifts in labor markets have reduced entry-level hiring at large tech firms, increasing the pool of skilled workers willing to join scam operations for income.

"AI is making it harder and harder for people to get a job, especially those with a criminal background," says Hieu Minh Ngo, a Vietnamese ex-hacker and founder of the non-profit Chong Lua Dao (Scam Fighters). "Before, people got trafficked against their will to scam compounds. Nowadays, people go there willingly to work."

Reports from Infoblox and Washington-based C4ADS document how scammers use AI chatbots for deceptive conversations, fluent translation to expand victim pools, and AI-powered monitoring tools to manage trafficked workers. The result is a "perfect storm" of AI, advanced malware and economic hardship that produces more destructive, industrial-scale fraud.

Military police examine computers, smartphones and other equipment seized during a raid on a scam centre in Kandal province, Cambodia on July 17, 2025 —STR/POOL/AFP via Getty Images

How Attacks Work

Modern attacks are often fast and clinically effective. A victim might receive a call from someone posing as a trusted organization and be urged to download an app that mimics a real service. That fake app can present a counterfeit "know your customer" screen to harvest data, secretly capture biometric scans, intercept SMS one-time passwords (OTPs), and permit attackers to log into banking apps and transfer funds.

Infoblox documented fake apps impersonating airlines, banks, insurance regulators, tourism authorities and tax departments. With full device access, attackers can expand beyond theft into extortion, blackmail or corporate intrusions like ransomware. Many components of this ecosystem—malware, infrastructure access, scripts—are traded or rented in Telegram channels as "cybercrime-as-a-service."

Human Cost and Corruption

Survivor accounts paint a brutal picture. Nyuyen Van Luu, a 28-year-old rescued from a scam center near Poipet, describes compounds ringed by barbed wire and guard towers, dormitories packed with a dozen people per room, and severe physical and sexual abuse for those who failed to meet quotas. He and other victims say corruption and official complicity helped the operations flourish, a claim echoed in U.S. legislation that cites corrupt local politicians across Cambodia, Laos and Myanmar.

International pressure and sanctions have prompted some action: Cambodia has reported closures of hundreds of scam sites and mass deportations of suspected foreign scammers, and several alleged kingpins have faced sanctions or legal action. Observers, however, remain skeptical about the depth and sincerity of enforcement.

Shifting Targets

Experts say sanctions and arrests have pushed scammers to focus on the Global South, where victims in parts of Latin America and Africa may be less aware of scams and have fewer advanced security tools. Those regions also serve as testing grounds where malware can be refined before being deployed against targets in the Global North.

Practical Protection Tips

Cybersecurity specialists recommend basic precautions: install apps only from official app stores, never grant remote-control or "device administrator" privileges to unknown apps, and avoid installing .apk files from untrusted sources. Beware unsolicited calls asking you to install software or to provide biometric scans, and enable multi-factor authentication methods that do not rely on SMS when possible.

"It’s getting more and more sophisticated all the time," says Hieu Minh Ngo. "But common-sense protections and awareness can still stop many of these attacks."