What Happened
In January 2026, cybersecurity firm Infoblox published a detailed investigation into the pig butchering-as-a-service economy, documenting two specific vendors operating inside the supply chain that powers Chinese-linked romance fraud at industrial scale. Researchers Maël Le Touz and John Wòjcik spent months tracking underground marketplaces and found a commoditized fraud ecosystem where specialized vendors supply separate layers of the operation: PII and stolen accounts, fake trading platforms and apps, CRM management tools, and crypto laundering infrastructure. Their conclusion was unambiguous: 'Sophisticated Asian crime syndicates have created a global shadow economy from their safe havens in Southeast Asia.'
The scam model itself — sha zhu pan in Mandarin, or pig butchering — is not new. A target is cultivated over weeks or months through a fake romantic or friendship relationship, gradually introduced to an 'investment opportunity' on a platform the scammer controls, encouraged to deposit increasingly large sums, and then cut off when the operator decides the victim has been fully 'slaughtered.' What is new is the infrastructure behind it, and how thoroughly it has been productized.
The Supply Chain, Layer by Layer
The Penguin Account Store is the raw materials layer. It sells pre-registered social media accounts from Tinder, X, Instagram, Snapchat, Facebook, WhatsApp, and others, starting at $0.10, with pricing increasing based on account age and apparent authenticity. It sells 'shè gōng kù' databases, meaning stolen PII covering bank records, travel history, political affiliations, and family information, used to identify high-value targets and enrich social engineering. It sells pre-registered SIM cards, 4G and 5G routers, IMSI catchers, and 'character sets,' which are curated packages of stolen photos used to build convincing fake personas.
Penguin also operates SCRM AI, a social CRM platform that uses AI to help scam operators manage and partially automate conversations with multiple victims simultaneously. The same operator advertises BCD Pay, an anonymous peer-to-peer payment processor linked to Bochuang Guarantee, with roots in illegal online gambling networks, providing a laundering off-ramp built into the service stack.
UWORK is the platform layer. It provides CRM admin panels for managing scam agents and victims, pre-built fake investment website templates covering crypto, forex, and gold, geofencing tools to keep the site invisible to visitors from high-risk jurisdictions, and backend dashboards tracking profitability metrics for each agent. Infoblox researchers purchased access to UWORK and documented the full admin panel. UWORK was specifically cited by U.S. law enforcement in connection with a February 2025 pig-butchering arrest resulting in charges for defrauding victims of over $13 million.
The fake trading platforms themselves integrate with legitimate data feeds and tools like MetaTrader, displaying real-time market data to make the fraud appear credible. Mobile apps are distributed through Android APK sideloading and iOS provisioning files that bypass app store review. Some apps have been uploaded directly to official marketplaces disguised as news or utility tools, with the trading panel revealed only when a victim enters a specific password. The entire technical stack — from the first romantic message to the moment funds are moved to a crypto wallet — can be purchased, assembled, and deployed by an operator with no technical background.
The Physical Infrastructure
Behind the online ecosystem are physical compounds. Chinese-speaking criminal networks have been building scam centers inside special economic zones in Cambodia, Laos, Myanmar, and the Philippines since approximately 2016. The Golden Triangle Economic Zone in particular has been documented by INTERPOL and Infoblox as a large-scale operation running multiple fraud types simultaneously: romance scams, investment fraud, and sextortion.
Workers in these compounds are not employees. They are trafficked. Victims are recruited with promises of legitimate technology or sales jobs, flown to Southeast Asia, and have their passports confiscated on arrival. They are forced to run scams under threat of violence. Infoblox estimates tens of thousands of people from dozens of countries are currently working in these conditions. The same compounds that use PBaaS vendor services to run their operations are also themselves a trafficking operation.
What This Means for You
The existing pig butchering article on this site covers the victim psychology: how the grooming works, why intelligent people fall for it, what the warning signs look like. That piece remains relevant. What the Infoblox research adds is the operational picture, and it changes how you should think about the threat.
This is not a scam. It is a production line. The person messaging you on a dating app or LinkedIn is likely reading from a script, working a shift, managing multiple simultaneous conversations through an AI-assisted CRM platform, and logging your responses into a profitability dashboard. The 'relationship' is a product being manufactured and delivered. The emotional investment you feel is the intended output of an engineered system.
The practical defense is the same as it has always been: no legitimate investment opportunity arrives through a romantic or social contact who approaches you first. No platform you were introduced to through a personal relationship is trustworthy for financial transactions. Any platform asking you to deposit crypto to an external wallet controlled by someone you met online is a fraud. The sophistication of the infrastructure does not change the tell. The tell is still the unsolicited relationship that leads to money.
The larger point for Bitcoin holders specifically: these operations deliberately drive victims toward crypto because it is fast, final, and largely irreversible. The crypto rails are not incidental to the scam. They are the exit infrastructure. Once funds are on-chain and moving through instant exchange services, the window for recovery closes in hours. The FBI's recovery statistics for crypto-denominated pig butchering losses are not encouraging.
What to Watch
Infoblox notes that as PBaaS matures, operations are expected to become more automated, more global, and more adaptive. The SCRM AI platform Penguin operates is an early signal of where this goes: AI-managed victim engagement that scales emotional manipulation without scaling headcount. Watch for U.S. or international law enforcement action targeting PBaaS vendors specifically, rather than individual scam operators. Infoblox and other researchers have argued that disrupting the supply chain, the data vendors, platform providers, payment processors, and DNS infrastructure, is the only enforcement strategy likely to meaningfully reduce volume. Arresting individual operators running UWORK templates changes nothing about the underlying infrastructure.