Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

The Imitation Game: Using Large Language Models as Chatbots to Combat Chat-Based Cybercrimes

Yifan Yao, Baojuan Wang, Jinhao Duan, Kaidi Xu, ChuanKai Guo, Zhibo Eric Sun, Yue Zhang

TL;DR

The paper addresses chat-based cybercrime by replacing passive detection with active, LLM-driven engagement. It introduces LURE, an end-to-end system that discovers illicit channels, identifies target accounts, and sustains adversarial dialogue to elicit operational details while handling multimedia content via OCR. In a large-scale Telegram study, LURE engaged 53 actors across 98 groups, achieving a 56.6% success rate in maintaining human-like conversations and revealing scam mechanics, pricing, and payment methods. The findings support a shift toward AI-driven defense that disrupts criminal workflows, with attention to ethical safeguards and deployment trade-offs. This work offers a concrete, scalable path for preemptive intelligence gathering and disruption of trust-based cybercrime ecosystems.

Abstract

Chat-based cybercrime has emerged as a pervasive threat, with attackers leveraging real-time messaging platforms to conduct scams that rely on trust-building, deception, and psychological manipulation. Traditional defense mechanisms, which operate on static rules or shallow content filters, struggle to identify these conversational threats, especially when attackers use multimedia obfuscation and context-aware dialogue. In this work, we ask a provocative question inspired by the classic Imitation Game: Can machines convincingly pose as human victims to turn deception against cybercriminals? We present LURE (LLM-based User Response Engagement), the first system to deploy Large Language Models (LLMs) as active agents, not as passive classifiers, embedded within adversarial chat environments. LURE combines automated discovery, adversarial interaction, and OCR-based analysis of image-embedded payment data. Applied to the setting of illicit video chat scams on Telegram, our system engaged 53 actors across 98 groups. In over 56 percent of interactions, the LLM maintained multi-round conversations without being noticed as a bot, effectively "winning" the imitation game. Our findings reveal key behavioral patterns in scam operations, such as payment flows, upselling strategies, and platform migration tactics.

The Imitation Game: Using Large Language Models as Chatbots to Combat Chat-Based Cybercrimes

TL;DR

The paper addresses chat-based cybercrime by replacing passive detection with active, LLM-driven engagement. It introduces LURE, an end-to-end system that discovers illicit channels, identifies target accounts, and sustains adversarial dialogue to elicit operational details while handling multimedia content via OCR. In a large-scale Telegram study, LURE engaged 53 actors across 98 groups, achieving a 56.6% success rate in maintaining human-like conversations and revealing scam mechanics, pricing, and payment methods. The findings support a shift toward AI-driven defense that disrupts criminal workflows, with attention to ethical safeguards and deployment trade-offs. This work offers a concrete, scalable path for preemptive intelligence gathering and disruption of trust-based cybercrime ecosystems.

Abstract

Chat-based cybercrime has emerged as a pervasive threat, with attackers leveraging real-time messaging platforms to conduct scams that rely on trust-building, deception, and psychological manipulation. Traditional defense mechanisms, which operate on static rules or shallow content filters, struggle to identify these conversational threats, especially when attackers use multimedia obfuscation and context-aware dialogue. In this work, we ask a provocative question inspired by the classic Imitation Game: Can machines convincingly pose as human victims to turn deception against cybercriminals? We present LURE (LLM-based User Response Engagement), the first system to deploy Large Language Models (LLMs) as active agents, not as passive classifiers, embedded within adversarial chat environments. LURE combines automated discovery, adversarial interaction, and OCR-based analysis of image-embedded payment data. Applied to the setting of illicit video chat scams on Telegram, our system engaged 53 actors across 98 groups. In over 56 percent of interactions, the LLM maintained multi-round conversations without being noticed as a bot, effectively "winning" the imitation game. Our findings reveal key behavioral patterns in scam operations, such as payment flows, upselling strategies, and platform migration tactics.
Paper Structure (18 sections, 13 figures, 2 tables)

This paper contains 18 sections, 13 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Motivation and Scope
  4. Motivation
  5. Threat Model and Scope
  6. Design of LURE
  7. Channel Discovery
  8. Target Account Identification
  9. LLM-Based Engagement and Data Collection
  10. Evaluation
  11. Experiment Setup
  12. Experiment Results
  13. Case Studies
  14. Discussion
  15. Board Impacts and Ultimate Objective
  16. ...and 3 more sections

Figures (13)

  • Figure 1: Utility of In-App APIs in Telegram
  • Figure 2: Example of a nude video chat conversation
  • Figure 3: Design of LURE
  • Figure 4: Example of identifying adult chat-for-hire service language via LLMs
  • Figure 5: System Prompt for LLM-based Engagement
  • ...and 8 more figures