Anansi: Scalable Characterization of Message-Based Job Scams

TL;DR

Anansi is a scalable measurement pipeline that systematically analyzes message-based job scams, uncovering scammer behaviors, infrastructure reuse, and significant financial losses, thereby advancing large-scale fraud ecosystem research.

Contribution

We introduce Anansi, the first end-to-end system combining LLMs and automation to analyze and characterize job scam ecosystems at scale.

Findings

Collected over 29,000 scam messages and interacted with 1,900 scammers.

Uncovered extensive reuse of message templates, domains, and wallets.

Identified millions of dollars in cryptocurrency losses.

Abstract

Job-based smishing scams, where victims are recruited under the guise of remote job opportunities, represent a rapidly growing and understudied threat within the broader landscape of online fraud. In this paper, we present Anansi, the first scalable, end-to-end measurement pipeline designed to systematically engage with, analyze, and characterize job scams in the wild. Anansi combines large language models (LLMs), automated browser agents, and infrastructure fingerprinting tools to collect over 29,000 scam messages, interact with more than 1900 scammers, and extract behavioral, financial, and infrastructural signals at scale. We detail the operational workflows of scammers, uncover extensive reuse of message templates, domains, and cryptocurrency wallets, and identify the social engineering tactics used to defraud victims. Our analysis reveals millions of dollars in cryptocurrency losses, highlighting the use of deceptive techniques such as domain fronting and impersonation of well-known brands. Anansi demonstrates the feasibility and value of automating the engagement with scammers and the analysis of infrastructure, offering a new methodological foundation for studying large-scale fraud ecosystems.