From Dark Markets to Deepfakes: How Cybercriminals Are Weaponizing Crypto and AI

It’s not just hackers lurking in the shadows anymore-today’s cybercriminals have gone corporate, leveraging crypto assets, artificial intelligence, and sophisticated social engineering to outpace law enforcement and destabilize economies. At the fifth international CyberSEC conference in Rome, experts from law enforcement, cybersecurity firms, and finance revealed a chilling new normal: the battleground of crime has shifted irreversibly from back alleys to the blockchain.

Antonio Mancazzo of Italy’s Guardia di Finanza described a dramatic shift: “We’re witnessing a progressive move of illicit activities from physical to virtual marketplaces.” Criminals exploit the anonymity of the deep web and cryptocurrencies, selling everything from weapons and counterfeit documents to stolen data. The pseudo-anonymity of blockchain, once thought unbreakable, is being chipped away by relentless investigators-yet, legal and technical roadblocks persist. Without a unified justice fund for seized crypto assets, and with cryptocurrencies’ notorious volatility, authorities struggle to manage and convert these digital spoils before their value vanishes.

But the threat isn’t just technical. Nicola Dalla Benetta, from consultancy Protiviti Italia, highlighted how organizations are tripping over their own complexity. Legacy systems, siloed teams, and fragmented regulations create fertile ground for fraudsters. The solution? Move beyond traditional Security Operations Centers (SOCs) to “X Operations Centers,” where all data relevant to defense converges, and AI can detect patterns humans miss. Yet, without clear governance and cross-disciplinary training, even the best tech falls short.

Massimiliano Galvagna of Vectra AI brought the threat home with a personal tale: a WhatsApp message from his “CEO,” perfectly timed, with a convincing profile photo-classic smishing, but now turbocharged by context-aware AI. “These attacks work because they lower our guard,” he warned. Cognitive biases, not just code, are being weaponized. As AI enables criminals to tailor attacks with surgical precision-mimicking voices, crafting believable personas-old-school “gut feeling” is no longer enough.

Emilio Tonelli of OPSWAT explained how criminals use AI to profile victims and maximize ransomware payouts, shifting from indiscriminate “dragnet” attacks to bespoke digital heists. The same AI that powers business innovation now helps cybercriminals select the most lucrative targets and refine their malware. Meanwhile, defenders race to build AI tools to spot synthetic voices and files-an escalating arms race where the line between offense and defense blurs.

While the digital crime wave shows no sign of cresting, the experts at CyberSEC2026 agreed on one hope: victory depends on combining human vigilance with relentless technological innovation. As the fog of cyberwar thickens, only those who adapt-integrating training, governance, and AI-will avoid becoming collateral damage in the next big breach.

WIKICROOK

• Deep Web: The Deep Web is the part of the internet not indexed by search engines, including private databases, academic resources, and other restricted-access content.
• Ransomware: Ransomware is malicious software that encrypts or locks data, demanding payment from victims to restore access to their files or systems.
• Smishing: Lo smishing è una truffa digitale che sfrutta SMS ingannevoli per rubare dati personali o soldi alle vittime, spesso fingendosi enti affidabili.
• Security Operations Center (SOC): A Security Operations Center (SOC) is a team or facility that monitors, detects, and responds to cybersecurity threats 24/7 to protect an organization.
• Deepfake: A deepfake is AI-generated media that imitates real people’s appearance or voice, often used to deceive by creating convincing fake videos or audio.