eCrime 2026 Lisboa Accepted Peer-Reviewed Submissions

The managing chairs of APWG’s 2026 Symposium on Electronic Crime Research (APWG eCrime) are proud to announce the final roll of accepted papers for the 2026 edition of eCrime, representing some 14 important advances in cybercrime research from a field of more than 40 submissions this year.

These papers will be presented at APWG eCrime 2026 Lisboa next month in mixed sessions with general session talks by presenters from industry, law enforcement, NGOs and the multilateral community. In addition, the papers listed here will be published in IEEE Xplore as the proceedings of eCrime 2026, our 19th year as an IEEE conference. To all of our 2026 submitters, thank you for helping APWG and its global correspondents imagine a crime-free Internet in new and important ways.

Questions or pre-print requests, please contact ecrime2026@apwg.org

PhishTrace: Characterizing Phishing Websites from Dynamic Features

• Ridwan Arefin Islam (McGill University)
• Mohammad Mannan (Concordia University)

Phishing attacks have evolved from static HTML credential harvesting to dynamic, client-side data extraction. Although existing studies explore automated detection, they do not account for modern phishing websites leveraging JavaScript to fingerprint analysis environments, execute runtime payload decryption, and delay the rendering of malicious Document Object Models (DOMs) to evade detection. In this paper, we design adversarial attack simulations to demonstrate behavioral evasion tactics, e.g., runtime payload decryption (eval), interaction-gated decloaking (waiting for human mouse movements), and timebombing (setTimeout delays), to expose the systematic vulnerabilities of each paradigm, by attacking existing state-of-the-art models. Furthermore, we observe that dynamic tools attempting to bypass evasion via forced execution inevitably trigger dormant anti-fraud routines on legitimate sites, leading to false positives. To address existing models’ oversights, we propose PhishTrace, a dynamic JavaScript behavioral analysis model, which operates in an instrumented, headful browser environment, simulates human interaction, and monitors native JavaScript API calls. To overcome the operational latency of prolonged observation, we implement system-level time acceleration using libfaketime, compressing a 15-minute behavioral simulation to 46.25 seconds of real-world wall-clock time. Evaluating over 369,000 URLs, PhishTrace achieved an accuracy of 99.74% and a False Positive Rate of just 0.008%, maintaining an F1-score of 0.976 even 20 weeks post-training. We then conduct a 20-week longitudinal study of 18 state-of-the-art phishing detection models. In our benchmarks, while static (URL/HTML/JS) and visual layout models perform well on generic datasets, they suffer from severe temporal degradation when evaluated against JavaScript-heavy phishing sites. Additionally, by ablating dynamic features, we demonstrate that static analysis is insufficient, as F1-scores drop to 0.326.

Understanding the Security Impact of Blocklist-based Anti-phishing Intelligence Services in Practice

• Kyungchan Lim (University of Maryland)
• Eunjin Roh (Oregon State University)
• Jaehwan Park (University of Tennessee, Knoxville)
• Yonghwi Kwon (University of Maryland)
• Sanghyun Hong (Oregon State University)
• Doowon Kim (University of Tennessee, Knoxville)

Blocklist-based anti-phishing mechanisms, such as Google Safe Browsing (GSB), play a crucial role in safeguarding Internet users from phishing attacks by being integrated with modern browsers. However, prior studies and their findings are often limited to small-scale lab environments, in part due to the black-box nature of GSB. Specifically, GSB operates on hashed versions of phishing URLs, making it difficult to assess its effectiveness.

In this paper, we aim to investigate the security impact and effectiveness of GSB by designing and conducting comparative analyses with existing anti-phishing intelligence services. Over six months, we collect and measure phishing URLs from anti-phishing intelligence services and attempt to identify concrete phishing URLs from GSB to conduct a longitudinal study of phishing URLs. Our study sheds light on GSB's internals, providing a glimpse of its promptness and effectiveness against real-world phishing attacks. In particular, (1) 260,548 of the GSB's phishing URLs were identified by other phishing intelligence services, with an average time of 46 hours and 51 minutes, revealing a non-trivial protection delay for the GSB (e.g., enough time for phishing attackers to exploit the majority of their victims) and an opportunity for improvement in promptness. (2) Our technical analysis of the phishing websites missed by GSB reveals that websites employing evasive techniques are noticeably omitted. (3) GSB shows a proportion difference in non-technical areas with language bias (e.g., fails to detect phishing websites with specific languages), suggesting a critical area for improvement.

All the Pieces Matter! A Six-stage Analysis of an Underground Fraud Ecosystem on Dread

• Megha Sundriyal (MPI-SP)
• Dylan Raharja (Singapore University of Technology and Design)
• Rui Cao (Singapore University of Technology and Design)
• Roy Lee (Singapore University of Technology and Design)
• Meeyoung Cha (MPI-SP)

Cyber-enabled fraud is a dominant global threat that causes severe financial loss, identity theft, and widespread psychological harm. This illicit economy relies on a highly specialized underground ecosystem where distinct actors exchange technical tools, operational techniques, and laundering channels. This research presents a case study of one such live fraud ecosystem from the perspective of a cohesive six-stage value chain spanning from preparation to monetization: Capability, Data Acquisition, Technique Sharing, Identity Forgery, Execution, and Extraction. Analyzing 67,976 posts and 305,048 comments from nine communities on the Tor-based darknet forum Dread, we map user trajectories, content distribution, and the adoption of generative AI. Our findings show that structural cohesion within the ecosystem is maintained by a thin layer of `bridgers' who generate the majority of all content. Against a degree-preserving null model, three knowledge-building upstream stages of the value chain form a tightly coupled cluster, whereas the remaining three operational downstream stages resolve into highly specialized populations with small personnel overlap. Finally, we demonstrate that generative AI is being rapidly but unevenly absorbed across the value chain; the technology saturates knowledge-building communities while operational stages remain largely untouched. By quantifying criminal specialization and structural integration, our network-based approach provides a framework for targeted, high-impact law enforcement interventions.

DarKnight: Retrieval-Guided Agentic Framework for Breaking Dark Web CAPTCHA Gates 

• Binghui Wu (National University of Singapore)
• Yeo Zi Yi (National University of Singapore) 
• Darren Tan (National University of Singapore) 
• Manit Baser (National University of Singapore) 
• Levente Csikor (A*STAR Institute of Advanced Intelligence and Compute (IAIC))
• Dinil Mon Divakaran (A*STAR Institute of Advanced Intelligence and Compute (IAIC)) 

Automated Cyber Threat Intelligence (CTI) monitoring of dark web marketplaces is heavily hindered by the diverse CAPTCHAs deployed by market operators. Traditional countermeasures rely either on unscalable per-site model fine-tuning or on commercial Vision-Language Model (VLM) APIs that violate the strict operational privacy and latency constraints of Tor-based deployments.

To address this, we develop DarKnight , a self-improving agentic framework designed to circumvent heterogeneous dark web CAPTCHAs using lightweight, open-weight VLMs. DarKnight orchestrates a perceive-plan-execute loop, utilizing a dual-signal Retrieval-Augmented Generation (RAG) knowledge base of successful and failed execution records to dynamically formulate optimal, image-specific preprocessing pipelines. Through a comprehensive evaluation across four real-world dark web datasets, we demonstrate that agentic tool selection outperforms brute-force parameter scaling.

Equipped with DarKnight, a deployable 8B instruct-tuned VLM reaches 85.4% on a heavily defended dataset (+45.4% over its own baseline), beating the 42.8% of a much larger 35B baseline and showing that adding the agentic layer to a small model beats scaling the bare model up. In addition, DarKnight recovers over 70% of baseline failures it acts on, at a 7.8% degeneration cost, confirming that an agentic pipeline equipped with proper tool selection successfully resolves degradation caused by blind or uniform preprocessing. This 8B local agentic loop completes within 3.57s, comfortably within typical session windows. Ultimately, DarKnight demonstrates that localized, adaptive tool orchestration can replace continuous model retraining and large-scale compute for dark web CAPTCHA solving.

A Tree-Structured Approach for Phishing Template and Attacker Attribution Analysis

• Unai Agirre (Vicomtech)
• Imanol Jerico (Vicomtech)
• Felipe Castaño (Vicomtech)
• Andrea Venturi (Vicomtech)
• Francesco Zola (Vicomtech)

Phishing remains a persistent and evolving cybersecurity threat, with attack volumes reaching record levels. This growth is driven by the industrialization of phishing through widely available phishing kits and reusable templates, which enable cybercriminals to rapidly generate and deploy large numbers of fraudulent webpages. Although surface-level attributes may differ across these websites, their underlying structures often exhibit significant similarities. However, most existing defenses rely on reactive blocklists or supervised classification models that focus on individual phishing instances, limiting their ability to identify structural reuse and detect coordinated phishing campaigns. To address this limitation, this study investigates whether HTML structure can serve as a robust fingerprint for identifying phishing template reuse. We model webpages as Document Object Model (DOM) trees and extract structural features, optionally enriched with HTML tag-based content information. These representations are then clustered using unsupervised learning methods to group structurally similar webpages. Three clustering algorithms are evaluated and compared, while also analyzing how the depth of the extracted DOM-tree affects cluster formation and overall clustering performance. Finally, cluster quality is also evaluated both quantitatively and qualitatively, including a novel level-wise Jaccard Distance Score and manual inspection supported by visualization tools. Results demonstrate that structural representations of webpages can effectively reveal hidden similarities across phishing sites, enabling the detection of emerging and zero-day templates and supporting the analysis of coordinated phishing threats.

Visa-Related Online Help-Seeking and Digital Scam Exposure: A Cross-Platform Security Measurement

• Hassan Alhassan (Indiana University Bloomington)
• Chen Ling (Indiana University Bloomington)

Non-immigrant visa holders and their families often rely on social platforms for time-sensitive guidance about travel, work authorization, and status maintenance. These high-stakes decisions can amplify security and privacy harms when advice is wrong or when third parties solicit money or sensitive documents.

We present a cross-platform measurement study of public, English-language visa-related conversations on Reddit, YouTube, and Telegram (2018--2025). Using a shared annotation schema, we label help-seeking intent, response types (including misleading/exploitative comments or replies), and URL destinations by risk (credible, low-risk, high-risk) to capture reply-based social engineering and link-mediated routing. Our dataset contains 32{,}395 posts and responses. Help-seeking is concentrated in YouTube comments, Telegram is substantially more link-heavy, and Reddit features more explicit scam-warning discourse. High-risk links are rare overall but more likely on YouTube and Telegram than on Reddit in our sample. We conclude with empirically grounded implications for safer help-seeking, including trusted routing to vetted resources and calibrated friction for risky destinations.

"I'm in Boss. What Next?": Characterizing the Telegram Scam Support Ecosystem

• Allison Lu (University of Florida) <allison.lu@ufl.edu>
• Bernardo B. P. Medeiros (University of Florida) <b.broetopontimed@ufl.edu>
• Jordan Greene (University of Florida) <jordangreene@ufl.edu>
• Kevin R. B. Butler (University of Florida) <butler@ufl.edu>
• Patrick Traynor (University of Florida) <traynor@ufl.edu>

Telegram has emerged as a major platform for enabling fraud. Key to this ecosystem is that few individual scammers develop the infrastructure and resources necessary to execute campaigns; rather, they purchase prebuilt kits and services to help in their endeavor. While recent work has looked at individual campaigns, the characteristics of this scam support ecosystem remain poorly understood. In this paper, we conduct a longitudinal measurement study of over 12,000,000 messages collected from 285 Telegram channels that are part of the scam support ecosystem spanning over a decade (2016--2026). Our results show that Telegram supports scam resource distribution, with 78% of all observed channels remaining active through the end of data collection. Overall, we find that the Telegram scam support ecosystem operates as a decentralized marketplace supported by reusable resources, self-maintained trust systems, and mechanisms for large-scale dissemination. Our analysis indicates that prevention efforts may benefit from targeting this scam support ecosystem, as it is responsible for enabling scam operators conducting a range of campaigns.

Built to Last? Registration and DNS Strategies in Phishing Domain Survival

• Kyungchan Lim (University of Maryland)
• Jaehwan Park (University of Tennessee, Knoxville)
• Raffaele Sommese (University of Twente)
• Mattijs Jonker (University of Twente)
• Ricky K. P. Mok (CAIDA/UC San Diego)
• kc Claffy (CAIDA)
• Doowon Kim (University of Tennessee, Knoxville)

Phishing defenses remain largely reactive: domains must be deployed, discovered, verified, and shared through blocklists before users are protected. This delay creates an exposure window that attackers can exploit. To better understand this window, we conduct a longitudinal measurement study of phishing DNS infrastructure using APWG and six additional blocklists. Our dataset spans July 2021 to April 2026 and covers 850K distinct phishing domains across 1,258 TLDs.

We analyze how detection survival varies across registration-time and infrastructure features, including TLD, registrar, target brand, and operational domain type. We find substantial survival differences across these features, suggesting that registration-time signals can support earlier detection. We then examine attacker adaptation around a major low-cost TLD disruption and find that abuse shifts toward paid or non-free alternatives without substantially shortening detection survival for maliciously registered domains. Finally, we group related phishing domains into infrastructure-level clusters using registration timing, TLD, registrar consistency, and lexical patterns (e.g., domain name), showing that related clusters can remain observable beyond individual domain lifetimes.

The Promise of Strategic Agentic Scambaiting

• Abhishek Satyam (Fordham University)
• Hossein Siadati (Cybera Global)
• Haadi Jafarian (University of Colorado Denver)
• Sima Jafarikhah (University of North Carolina Wilmington)
• Juntao Chen (Fordham University)

Scammers have increasingly adopted AI-driven capabilities, evolving from automated message generation to fully agentic conversational systems that scale operations and maximize the exploitation of fraudulent resources before detection and takedown. In parallel, agentic scambaiting has emerged as a defensive approach in which autonomous agents impersonate potential victims and engage scammers in sustained interactions to extract actionable threat intelligence, such as mule bank accounts and cryptocurrency wallet addresses, that can be reported to disrupt fraudulent infrastructures. Together, these developments transform online fraud into an adversarial socio-technical ecosystem in which autonomous scamming and scambaiting agents engage in deceptive interactions while competing over the discovery, preservation, and exploitation of one another’s resources. A fundamental and largely unexplored question is how defensive scambaiting can remain effective in an agent-to-agent environment, and under what conditions either side gains a strategic advantage. In this paper, we present a formal model of agent-to-agent fraud interactions that captures the strategic decision spaces available to both attackers and defenders. Using this framework, we analyze the dynamics of engagement, resource consumption, belief adaptation, and disruption outcomes. We find that scammer profitability turns negative once baiting-agent prevalence exceeds certain thresholds, and that when both sides improve at the same pace, defender investment in mimicry quality outpaces equivalent gains in scammer detection capability, so the arms race favors the defender under our baseline parameters. Our model and findings provide insights into the stability, scalability, and long-term effectiveness of autonomous defensive agents in an evolving AI-mediated fraud landscape.

Visibility-Aware HTML Analysis through Renderer-Level Extraction

• Lucas Betts (University of Auckland)
• Eric Spero (University of Auckland)
• Robert Biddle (University of Auckland)
• Danielle Lottridge (University of Auckland)
• Giovanni Russello (University of Auckland)

Email attackers increasingly exploit advanced CSS and rendering behaviours to conceal malicious text from recipients while still influencing filter-visible content. Existing detection approaches operate either on HTML, where CSS flexibility makes concealment difficult to reason about, or on OCR of rendered screenshots, which is computationally expensive and prone to recognition errors. This paper presents a large-scale empirical analysis over approximately 1 million unique emails, demonstrating that low-level paint operations emitted by Chromium contain sufficient information to identify several classes of content concealment without relying on OCR. By extracting renderer-level features and aggregating them into interpretable concealment signals, we show that these techniques can be applied at scale to characterise and prioritise suspicious emails. Renderer-level analysis therefore offers a practical alternative to HTML-based and OCR-based methods, enabling lightweight server-side screening, in-client warnings about suspicious rendering, and user-focused “visibility repair” that restores concealed content so recipients can make informed judgements about the legitimacy of an email.

The “Allow” Reflex: Permission-Scope Misinterpretation as a Socio-Technical Exposure in Mobile Cybercrime

• Lakshmi Kandagadla Srinivasamurthy (University of Washington)
• Marc Dupuis (University of Washington)

Mobile permission prompts are often treated as moments of informed consent, but they also function as user-mediated access-control decisions. When users tap “Allow,” they may grant applications access to sensitive resources such as location, camera, and microphone, creating potential opportunities for misuse by malicious or deceptive applications. This study examines how users interpret mobile permission requests and how contextual factors shape permission decisions. We conducted a cross-sectional, scenario-based survey with 157 adult smartphone users recruited through Amazon Mechanical Turk. Participants evaluated three realistic permission scenarios involving location, camera, and microphone access. Results show a substantial gap between perceived understanding and actual comprehension. Across scenarios, perceived understanding ranged from 89.2% to 96.8%, while correct comprehension ranged from only 30.6% to 43.9%. Camera and microphone permissions, presented in a live video-call context, produced especially high grant rates of 90.4% and 94.3%. Trust, social influence, app familiarity, and perceived risk were associated with permission decisions, while open-ended responses suggested that users often relied on task relevance, trust, resignation, and incomplete assumptions about permission scope. These findings suggest that mobile permission prompts may record formal approval without reliably producing meaningful understanding. We frame permission-scope misunderstanding as a socio-technical exposure relevant to mobile cybercrime, where sensitive access may be obtained through user approval rather than technical compromise.

Suspected Foreign Influence Activity in Korean News Discussions on YouTube

• Hyeonseung Kim (Korea Advanced Institute of Science and Technology)
• Jaehong Kim (Korea Advanced Institute of Science and Technology)
• Meeyoung Cha (Max Planck Institute for Security and Privacy)
• Wonjae Lee (Korea Advanced Institute of Science and Technology)

Online news comment sections are highly vulnerable to coordinated and deceptive participation. This paper analyzes 67 million comments posted by 2 million users on 296,000 videos from seven major Korean news channels during a period of high political volatility (including martial law), examining the patterns of foreign state-suspected influence campaigns on YouTube. We identify 6,291 suspected accounts that exhibit a tightly-knit network often known as coordination, replying to one another within comment threads and repeatedly co-occurring on the same niche videos. Rather than focusing on Korean domestic politics, their activity often concentrates on foreign geopolitical actors, characteristically pairing praise of a specific out-group state with condemnation of Korea. This strategic rhetoric acts as an engagement magnet, attracting more replies from ordinary users. Ultimately, our findings reveal that the impact of foreign influence operations extends far beyond individual posts, actively reshaping the surrounding civic discourse and demonstrating how state-aligned narratives can organically diffuse across threaded online spaces.

Read This Paper to Get $50 Million:* An Analysis of Mobile Messaging Scams Using Reddit Data

• Allison Lu (University of Florida)
• Bernardo B. P. Medeiros (University of Florida)
• Kevin R. B. Butler (University of Florida)
• Patrick Traynor (University of Florida)

Mobile messaging scams--fraudulent messages delivered over SMS and other mobile applications--have become a persistent and evolving security threat, yet the attributes underlying these campaigns remain unclear. This study seeks to address this gap by examining trends in mobile messaging scams and testing the effectiveness of commercial and open-source off-the-shelf detection tools. We characterize mobile messaging scam operations, focusing on how phone numbers, URLs, and text content are used across campaigns. To achieve this objective, we collect and measure a dataset of 175,430 user-reported mobile messaging scams from Reddit between June 2020 and December 2025. While reply-based scams constitute only 50% of our dataset, their compound annual growth rate (99.98%) is nearly twice that of click-based scams (57.29%). Critically, reply-based scams also show the lowest detector performance--despite identifiable similarities in text content and phone number origin within categories--indicating that current off-the-shelf tools are ineffective. These results suggest that further development of detectors is necessary to defend against this rapidly changing ecosystem. By examining a range of message attributes, this work provides new insights into mobile messaging scams, informing the design of more targeted and robust detection methods.

PasteJacked: Detection and Characterization of Clipboard-Hijacking Attacks

• Mohamed Nabeel (Palo Alto Networks)
• William Melicher (Palo Alto Networks)
• Oleksii Starov (Palo Alto Networks)<

Pastejacking, the social engineering technique of silently overwriting a victim's clipboard with a malicious shell command via the browser Clipboard API and instructing them to paste it in a terminal, has become a prevalent initial-access vector recently. Traditional detectors have a blind spot to these attacks, which is addressed in this work. First, we present a two-layer detection pipeline. The first layer is a lightweight signature filter applied to clipboard content; it identifies pages where a paste event contains a shell command with one or more URLs. The second layer, PasteJack Agent, is an agentic system that orchestrates five tools: clipboard deobfuscation, domain reputation, multimodal screenshot analysis, HTML source analysis, and live web search, applied only to pages that pass the first layer, making deep analysis practical at scale. Second, we present a longitudinal measurement study of the pastejacking ecosystem, covering 31,868 unique lure URLs over approximately 90 days (March-May 2026). We characterize seven dimensions: temporal growth (7×7× in 10 weeks), three-tier lure infrastructure (56.3% compromised legitimate sites, 43.7% attacker-registered domains, and 2.7% rentable hosted platforms), more than 60 distinct campaign clusters, 15 payload obfuscation families, 12,225 unique C2 endpoints, bimodal lure lifetime (median 9.93 days among re-observed URLs), and trusted-platform abuse across nine rentable services. Our findings suggest that layered detection improves coverage over traditional detectors, and that IOC-based defenses tend to lose effectiveness within hours of publication, motivating content-level and behavioral mitigations.