Most people think of criminal hackers as technology masterminds who are experts at covering their tracks. But it turns out many cyber criminals are just like the rest of us—they prefer convenience over security.
According to a new report by the security company Flashpoint, which scours underground web forums where cyber scammers hang out, the most popular communication tool is Skype, a Microsoft product that lacks advanced privacy features.
“Skype is by far the most frequently mentioned messenger across the language communities in this study. Skype was among the top five messengers in all of the language groups [except] French, Persian, and Chinese language communities,” said the report, adding that Microsoft’s bundling of Skype with its products helps to explain its popularity.
Other popular messaging services include Jabber (a secure, open-source messaging system), Telegram, and Facebook-owned WhatsApp. All three of these services include end-to-end encryption, and make it difficult for law enforcement to identify the real identify of their users.
Get Data Sheet, Fortune’s technology newsletter.
While cyber criminals can communicate directly on so-called “dark web” forums, it is common practice for them to include an instant messaging handle (like a Skype name), where they can be reached directly. This is in part due to the fact that those forums often disappear without warning, along with all their communications history.
The Flashpoint study does not provide specific numbers to break down how many hackers are using the various messaging tools. But Leroy Terrelonge III, one of the company’s research directors, told Fortune the data was compiled from thousands of underground forums. He added Flashpoint was surprised by the results.
“Given the caliber of cyber criminals we’re monitoring, I thought they would be using the most secure forms of communications but a lot are happy to use Skype,” said Terrelonge. “It really shows these criminals, who we build up in our head as super bad guys get lazy and use tools that are easy to use.”
The Flashpoint report, which presents its findings by language groups, also compares findings from 2012 and 2016. One potential surprise is the ongoing popularity of an app called ICQ, which was created by an Israeli company, which was then bought by AOL, and in turn acquired by the Russia-owned conglomerate Mail.Ru. As Flashpoint notes, the use of ICQ is in part driven by its popularity among Russian speakers, who are regarded as the most elite cyber criminals.
Here is breakdown of the top messaging apps in English-speaking forums:Flashpoint, which monitors dark web activity to warn companies of criminal activity, added that the popular, super-secure app known as Signal is not included in the results because its name is so commonly used in other contexts, but that many hackers appear to be using it.
