Abstract: Systems and methods of monitoring and detecting suspicious activity in a virtual environment are provided. In one exemplary embodiment, a method performed by a first network node of monitoring and detecting suspicious activity in a virtual environment comprises sending, to a second network node that operates a virtual environment, an indication that user activity performed in the virtual environment that is associated with a certain user profile of a plurality of user profiles of the virtual environment is suspicious activity. Further, the user activity performed in the virtual environment that is associated with the certain user profile is enabled by a third network node. In addition, the suspicious activity is determined based on a relationship between the user activity performed in the virtual environment that is associated with the certain user profile and other user profiles, or an attribute of the certain user profile or the third network node.