Anansi: Scalable Characterization of Message-Based Job Scams
This paper introduces Anansi, a scalable, automated pipeline that leverages LLMs and browser agents to systematically engage with and characterize over 29,000 job-based smishing scams, revealing extensive infrastructure reuse, sophisticated social engineering tactics, and millions of dollars in cryptocurrency losses.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine a massive, invisible fishing net cast into the ocean of the internet. Instead of fish, this net is trying to catch scammers who are pretending to offer remote jobs. But here's the twist: the people casting the net aren't just watching; they are actively pretending to be the victims to see exactly how the trap works.
This is the story of Anansi, a new research project from Stony Brook University. Named after a clever spider from folklore who tricks larger animals, Anansi is a high-tech "spider" designed to catch and study job scams.
Here is how it works, broken down into simple parts:
1. The Hook: How the Scam Starts
You know those texts you get that say, "Hey! We found your resume on LinkedIn. Want to make $400 a day rating products from home?"
- The Reality: It's a trap.
- The Trap: The scammer builds trust first. They pretend to be a nice HR manager. They might even send you a fake business license. Once you trust them, they say, "Great! To start, you need to register on our website and do a few small tasks."
2. The Bait: The "Task" Scam
Once you are on their fake website, they give you a "job."
- The Job: You might be asked to "like" a YouTube video, "review" a product on Amazon, or download an app.
- The Lure: At first, it feels real. You do the task, and they actually pay you a tiny bit (like $5 or $10) into your crypto wallet. This is the "pig butchering" technique: they fatten the pig (you) with small treats so you trust them before they slaughter you.
- The Slaughter: Eventually, they say, "To withdraw your big earnings, you need to deposit a larger amount first to 'unlock' your account." That's when you lose your money.
3. The Researcher's Tool: Anansi
The researchers realized that studying these scams was like trying to catch a ghost. Scammers change phone numbers and websites constantly. So, they built Anansi.
Think of Anansi as a robotic detective with a superpower: AI.
- The Detective: Anansi automatically sends messages to thousands of scammer phone numbers.
- The Actor: When a scammer replies, Anansi doesn't just say "Hello." It uses a Large Language Model (AI) to role-play a real person. It creates a fake persona (a name, a job history, a personality) and chats with the scammer just like a real victim would.
- The Goal: The robot keeps the conversation going just long enough to trick the scammer into revealing their secrets: their fake website links, their customer support chat, and most importantly, their crypto wallet addresses where the stolen money goes.
4. What Did They Find?
Over 10 months, Anansi chatted with over 1,900 scammers and analyzed 29,000 messages. Here are the big discoveries:
- The "Cookie-Cutter" Scam: Scammers aren't creative. They use the exact same scripts. If you see a message that says "Hello, I'm Jasmine from Target Recruiting," it's likely the same script used by hundreds of other scammers, just with a different name.
- The "Ghost" Infrastructure: Many of these fake job websites are hosted on the same servers. It's like finding 12 different "fake" stores all located in the same abandoned warehouse. They also use sneaky tricks like Domain Fronting, where a website looks like a maintenance page to security scanners but redirects real people to the scam site.
- The Money Trail: By following the crypto wallets the scammers shared, the researchers traced over $12 million in stolen money. Some individual scam operations made over $2 million!
- The "Fake Crowd": In Telegram groups, scammers show hundreds of "employees" working and getting paid. The researchers believe most of these "employees" are just bots (computer programs) pretending to be real people to make the scam look legitimate.
5. Why This Matters
Most security software is like a bouncer at a club who only checks for people with "bad" IDs (malware). But these job scams look like "good" IDs. They have nice websites and no viruses. They rely on social engineering (tricking your brain) rather than computer hacking.
Anansi proves that we can fight back by fighting fire with fire. By using AI to talk to scammers at a massive scale, researchers can map out their entire network, expose their tricks, and help build better defenses.
In short: Anansi is a digital spider weaving a web of AI conversations to catch the real spiders (scammers) before they can eat the victims. It turns the tables, showing us exactly how the trap is built so we can stop falling into it.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.