Content platforms increasingly being misused for human trafficking

Subscription-based content platforms are increasingly becoming a tool of organised crime. As part of the joint operation ‘CyberProtect III’, INTERPOL, the Organisation for Security and Co-operation in Europe (OSCE) and several international partners have gained new insights into the systematic use of digital platforms for sexual exploitation and human trafficking. The investigation reveals how criminal networks utilise modern technologies, encrypted communication channels and artificial intelligence to establish and operate large-scale exploitation networks.

Fourteen law enforcement officers from Germany, the Netherlands, Romania, Spain, Sweden, Ukraine and the United Kingdom took part in the four-day operation in May 2026. The initiative was supported by the cybersecurity firm Group-IB, which provided its Threat Intelligence Graph technology for analysing criminal infrastructure.

Investigators identified a total of 34 suspicious cases, 18 suspected perpetrator profiles and 27 potential victims. With the help of the analysis platform, digital infrastructures, communication patterns and financial flows could be linked together and placed within a coherent investigative context.

Organised crime exploits the platform economy

The investigations show that criminal networks specifically use content subscription services to recruit and exploit women, minors and particularly vulnerable adults. Victims are often lured in with promises of income or supposed modelling opportunities. Once contact has been established, the perpetrators take control of the victims’ accounts, retain the majority of the earnings and increasingly apply psychological pressure to force the creation of ever more explicit content.

The perpetrators operate in a highly professionalised manner and use digital tools to scale up their activities. A key phenomenon is so-called ‘e-pimping’ – the orchestrated sexual exploitation facilitated by digital platforms, automated processes and social media.

AI and encrypted communication are accelerating exploitation

The operation brought to light a range of new tactics. For instance, criminal groups are increasingly relying on AI-generated fake profiles to supplement human-operated exploitation networks and expand their reach. At the same time, the recruitment of potential victims often takes place via encrypted messaging services that do not require age verification. Investigators documented cases in which nude images were requested as early as the first contact.

The scale of this criminal economy is particularly alarming. In one messaging group under investigation, investigators found up to 28,000 posts in which content producers were traded and brokered. Means of payment include cryptocurrencies and virtual currencies, which are transferred using symbols such as diamond emojis. In some cases, prices were as low as three US dollars for 25 minutes of a private video stream.

Furthermore, investigators identified a high concentration of South American women as the region of origin for both real and virtual exploitation networks.

Digital platforms are becoming part of organised crime

According to David Caunter, Director of Organised and Emerging Crime at INTERPOL, every identification of suspects and potential victims provides immediate leads for investigations and strengthens law enforcement agencies’ ability to dismantle criminal networks and protect vulnerable individuals.

Group-IB also sees this development as a fundamental shift in the digital threat landscape. “Criminal networks that misuse digital platforms to exploit and coerce vulnerable people are among the most harmful actors in today’s threat landscape,” explains Dmitry Volkov, CEO of Group-IB. He adds that cooperation between the private sector and law enforcement agencies is crucial to identifying the perpetrators’ infrastructure, recruitment channels and financial flows at an early stage and effectively disrupting them.

Information gathering is becoming a key factor

The findings of CyberProtect III highlight that digital platforms are increasingly being misused as the infrastructure for organised crime. Human trafficking and sexual exploitation no longer take place exclusively in physical spaces, but are shifting to encrypted communication environments, social networks and subscription-based platform economies.

For security agencies and cybersecurity organisations, the ability to identify technical infrastructure, digital financial flows and criminal communication networks at an early stage – and to correlate them with one another – is therefore becoming increasingly important. At the same time, the operation demonstrates that cyber threat intelligence now extends far beyond traditional IT security incidents and is increasingly becoming a tool in the fight against the most serious forms of organised crime.