Employees are getting smarter, paying more attention to emails in their inbox and treading cautiously before downloading a suspect file or responding to requests from an impostor CEO. But this is an arms race, and malware creators aren’t shutting down servers and calling it a day just yet.

As noted by SC Magazine, malware campaigns are now using designer tactics to more effectively target local and niche businesses. Here’s a look at the new world of couture cybercrime.

Breaking Brand

Most companies are familiar with traditional malware brands. Often using spray-and-pray tactics, these large-scale threats went after every target they could find in hopes of getting just a few to take the bait. But generic is no longer getting the job done.

SC Magazine stated that cybercriminals are “becoming ever more proficient at using localized language and vernacular in phishing emails and ransomware notes.”

According to ComputerWeekly, there’s been a sharp rise in the number of properly written and perfectly punctuated emails — a far cry from the familiar, barely legitimate dreck of common phishing attempts. Criminals are also narrowing their focus to spoof brands, logos and even enforcement agencies native to a particular region or culture for maximum impact.

It makes sense; when an email arrives that appears to be from local authorities, comes with seemingly legitimate contact details and is written in a flawless local dialect, the chance of fooling users increases.

Many malware-makers have taken the step of employing professional translation freelancers to do some of their dirty work. Those doing the conversion don’t know the ultimate purpose, and the fee incurred for this high-quality job is minimal compared to the potential windfall.

In addition, designer malware campaigns are actively avoiding certain regions. If an online geo IP lookup returns the address of a nontargeted country, the malware fails to activate or may even delete itself.

Malware Campaigns Go Back and Forth

This isn’t to say there’s no progress on the malware front. As noted by ZDNet, the Russian cybercriminal who developed and sold the Gozi malware has been handed a $7 million bill in addition to time served. While this is cold comfort to the millions victimized by Gozi, it’s a step in the right direction.

On the flip side, researchers have discovered an exploit of Windows’ so-called God Mode, which creates hidden folders and lets uses access advanced functions. The Dynamer malware leverages this feature to hide itself and wreak havoc without detection. But it’s not all bad — Dynamer isn’t hard to delete when found.

This is a market that’s primed for the kind of designer malware recently discovered. Criminals aren’t looking for millions of infections that will attract the attention of international authorities, and they don’t want the hit-or-miss results garnered by simple exploit tools like Dynamer.

Culture rather than code has become the weapon. It’s the new way to slide past spam sensors and convince targeted companies that they’re completely safe while they’re vastly increasing their risk. Couture cybercrime makes it tougher to tell counterfeit online interactions from the genuine article.