Cybercriminals are hiring women for more authentic social engineering scams — and are promising up to $1,000 per call
SLSH is recruiting women to increase effectiveness of social engineering on IT helpdesksApplicants are paid between $500 and $1,000 per call depending on successParticipants must pass screening questions and follow a scripted set of instructions
The notorious hacker group Scattered Lapsus$ Hunters, also known as SLSH, is reportedly recruiting women to improve the effectiveness of its social engineering operations.
Telegram posts dated February 22 and collected by Dataminr indicate the group is offering payments between $500 and $1,000 per call, depending on “success and hit rate.”
Applicants are instructed to contact the group’s “Support” account, answer screening questions, and, if accepted, follow a prepared script during calls.
Recruitment process and call structure
The objective appears to be to deceive IT help desk staff into providing login credentials that can later be used to access corporate networks, which aligns with the group’s known methods of manipulating internal support teams into resetting passwords or bypassing authentication procedures.
Experts who have monitored calls linked to affiliated actors describe the techniques as structured and effective.
“This recruitment drive represents a calculated evolution in SLH's tactics,” said Jeanette Miller-Osborn, field cyber intelligence officer at Dataminr.
“By specifically seeking female voices, the group likely aims to bypass the ‘traditional’ profiles of attackers that IT help desk staff may be trained to identify, thereby increasing the effectiveness of their impersonation efforts.”
SLSH’s recent campaign follows earlier public recruitment attempts conducted through Telegram.
In October 2025, the group offered $10 in Bitcoin to anyone willing to “endlessly harass” executives at organizations it was attempting to extort.
“You have permission to endlessly harass these executives till they comply with us,” the message stated, adding the activity would be “centralized and well operated.”
When questioned about participation levels, the group claimed it had “practically paid out over $1,000 at this point,” although that figure could not be independently verified.
The shift toward paid voice impersonation suggests continued reliance on outsourced participants rather than tightly controlled internal operations.
The recruitment activity comes amid sustained criminal pressure on major brands.
ShinyHunters alleged it had obtained 1.7 million CarGurus records and separately claimed Panera Bread as a victim of stolen credentials.
Ransomware attacks have continued to rise in 2025, with gangs reappearing under new names despite prior disruption efforts.
Miller-Osborn recommends that organizations make their help desks aware of these evolving tactics and ensure identities are verified through video calls or secondary internal confirmation.
Strengthening internal firewall rules and enforcing identity theft protection controls could help address this threat.
Also, implementing strict malware removal procedures may reduce exposure if credentials are compromised.
Cyber scams continue to thrive despite global raids, and the commercialization of social engineering, with auditions and performance-based pay, shows criminals rely more on human manipulation than on technical intrusion.
