Cybercrime-as-a-Service (CaaS) is a criminal business model in which attackers rent or buy tools, hosting, access, or workflow support instead of building everything themselves. Common offerings include phishing kits, malware loaders, botnet access, credential theft panels, and payment or laundering services. The seller handles much of the technical overhead, while customers focus on running attacks.
CaaS matters because it lowers the skill and cost needed to launch cybercrime, which increases volume and makes operations easier to scale. It also encourages specialization: one group may build infrastructure, another may deliver phishing lures, and others may collect and monetize stolen data. Defenders see this model in phishing-as-a-service panels, reusable exploit kits, and managed ransomware ecosystems. Effective defense relies on rapid takedowns, stronger identity controls, and monitoring for shared infrastructure that can support multiple campaigns at once.