Understanding Illicit Ecosystems: Weaponizing Mainstream Apps and Social Infrastructure

This Flashpoint analysis outlines how threat actors exploit mainstream, consumer-facing platforms — notably Discord, Telegram, Roblox, and Minecraft — to blend illicit activity into legitimate clearnet traffic, host and distribute malware (including infostealers and RATs via trusted CDNs), coordinate fraud and extortion, and recruit and groom victims (illustrated by the "The Com" predatory pipeline). The report emphasizes the operational advantages of public-to-private pipelines and urges monitoring of clearnet channels and OSINT to detect and disrupt these decentralized illicit ecosystems.