Over the past decade, online fraud has undergone multiple significant structural transformations. What originally began as the acts of individual criminals has evolved into a large, industrialized operations capable of mass exploitation. Pig butchering, a now common term for a broad range of fraud operations including investment fraud and romance baiting, has become the stock in trade for multiple large-scale syndicates based out of Southeast Asia. These syndicates are known to operate industrial facilities in Cambodia, Laos, Myanmar, the Philippines and other Southeast Asian countries, supported by complex money-laundering and human trafficking networks that bring tens of thousands of coerced workers for the sole purpose of executing pig butchering fraud at scale. These syndicates have developed a global shadow economy in which fraudulent activity is systematized and scaled with efficiency comparable to legitimate service industries and established cybercrime models such as malware-as-a-service and phishing-as-a-service. The infrastructure and services enabling this scale are collectively referred to as Pig Butchering-as-a-Service (PBaaS): a framework that provides the tools, infrastructure, and expertise to run extensive social engineering fraud operations with relatively low barriers to entry.
Central to the PBaaS concept are service providers that sell or lease complete fraud toolkits and platforms that would otherwise require technical competence and significant investment to develop. These offerings include stolen personal identifiable information (PII), credential lists, pre-registered social media accounts, bulk SIM cards, communication devices, and complete scam templates. These components are sold on underground marketplaces in Southeast Asia, and they support a wide range of fraud typologies including romance scams, fake investment opportunities, law enforcement impersonations, and employment scams. One such provider, identified as the “Penguin Account Store,” publicly advertises and sells comprehensive fraud kits and supporting infrastructure. Penguin’s offerings extend beyond simple data lists to include network-relevant tools such as stolen credentials from platforms like Tinder, WhatsApp, and developer accounts, pre-registered social profiles, and “character sets”—bundles of images and identity information used to create convincing scam personas. The actor also sells Social Customer Relationship Management (SCRM) systems marketed as “SCRM AI,” which facilitate large-scale victim engagement and automated management of scam accounts. These systems mirror the legitimate CRM tools used by brands to streamline outreach but are repurposed to manage social engineering campaigns and automate interactions that would otherwise require extensive labor.
The economic calculus for these fraud models demonstrates a high return on investment for syndicates. Basic templates with hosting can cost as little as US$50, while comprehensive packages that include administrative backends, VPS hosting, mobile apps, and even shell company formation can cost several thousand dollars. When paired with effective social engineering and broad victim targeting, these investments can yield profit margins exceeding tens of thousands of percent. With such a potential profit on the table, and with the technical demands of running such an operation approaching zero, it is no small wonder that PBaaS has become as ubiquitous as it has. What was once technically demanding and costly can now be acquired off the shelf, enabling numerous criminal networks to replicate operations rapidly and at minimal cost.
