The dark web is seeing sustained recruitment activity as more young and unemployed individuals seek work in illicit online markets, according to new research from Kaspersky Digital Footprint Intelligence. The study found that the number of résumés and job postings on underground forums doubled in Q1 2024 versus a year earlier, and remained at similar levels in Q1 2025.
In 2025, résumés outnumber vacancies 55 per cent to 45 per cent, a trend Kaspersky links to global layoffs and an influx of younger job seekers. The median age of candidates was 24, with analysts noting “a marked teenager presence”.
The findings appear in Kaspersky’s report Inside the Dark Web Job Market: Their Talent, Our Threat, ahead of its full publication on 20 November.
Growing youth presence in an illicit labour economy
Jobs advertised on the dark web are primarily tied to cybercrime or other illegal activities, though a small number of legitimate roles also appear. Kaspersky found that 69 per cent of job seekers did not specify any preferred field, indicating a willingness to accept roles ranging from programming tasks to running online scams.
Vacancies posted by criminal groups reflect a mature ecosystem. The most in-demand IT roles include developers (17 per cent), penetration testers (12 per cent) and money launderers (11 per cent), followed by carders (6 per cent) and traffers (5 per cent) who funnel users to phishing or malware sites.
Gender-based patterns also surfaced. Female applicants more often sought roles involving interpersonal interaction such as support, call-centre and technical-assistance work. Male candidates more frequently pursued technical and financial-crime positions.
Premiums for high-impact cybercrime skills
Salary expectations varied across roles, reflecting scarcity and risk. Reverse engineers commanded the highest average pay at over US$5,000 per month, followed by penetration testers at US$4,000 and developers at US$2,000. Fraud-focused roles often paid through revenue shares, with money launderers earning around 20 per cent, carders 30 per cent, and traffers 50 per cent.
Kaspersky analysts say these figures highlight a shadow job market that increasingly mirrors the structure and incentives of legitimate tech hiring.
“The shadow job market is no longer peripheral; it’s absorbing the unemployed, the underage and the overqualified,” said Alexandra Fedosimova, Digital Footprint Analyst at Kaspersky. She noted that many young applicants perceive the dark web as a skill-based marketplace with faster responses and fewer formalities, “but not many realize that working on the dark web can lead to prison”.
Warnings for youth and guidance for families
Kaspersky urged young people considering dark web roles to recognise the legal and long-term consequences. The company encouraged parents and educators to report suspicious online recruitment and to steer students towards lawful pathways in cybersecurity and technology.
The firm also highlighted its educational project What We Should Do With Kids Who Hack, which aims to rehabilitate and redirect young users with early technical skills.
Recommendations for individuals and organisations
To stay safe, Kaspersky advised individuals to avoid suspicious links and unsolicited offers on messaging platforms and forums. Teenagers were urged to report questionable posts to parents or authorities.
For organisations, the company recommended employee training, dark web monitoring for compromised credentials, and stronger fraud-detection measures. HR teams should also be trained to identify “shadow experience” when screening applicants.
Kaspersky will release the full report on 20 November, providing deeper analysis of dark web labour trends and emerging risks for businesses and young job seekers.
