Anansi: Scalable Characterization of Message-Based Job Scams

TL;DR

Anansi is presented, the first scalable, end-to-end measurement pipeline designed to systematically engage with, analyze, and characterize job scams in the wild, and demonstrates the feasibility and value of automating the engagement with scammers and the analysis of infrastructure.

Abstract

Job-based smishing scams, where victims are recruited under the guise of remote job opportunities, represent a rapidly growing and understudied threat within the broader landscape of online fraud. In this paper, we present Anansi, the first scalable, end-to-end measurement pipeline designed to systematically engage with, analyze, and characterize job scams in the wild. Anansi combines large language models (LLMs), automated browser agents, and infrastructure fingerprinting tools to collect over 29,000 scam messages, interact with more than 1900 scammers, and extract behavioral, financial, and infrastructural signals at scale. We detail the operational workflows of scammers, uncover extensive reuse of message templates, domains, and cryptocurrency wallets, and identify the social engineering tactics used to defraud victims. Our analysis reveals millions of dollars in cryptocurrency losses, highlighting the use of deceptive techniques such as domain fronting and impersonation of well-known brands. Anansi demonstrates the feasibility and value of automating the engagement with scammers and the analysis of infrastructure, offering a new methodological foundation for studying large-scale fraud ecosystems.

Figures (11)

• Figure 1: Anatomy of a Task Scam
• Figure 2: Examples of Scammer Messages
• Figure 3: A schematic representation of Anansi's pipeline
• Figure 4: Scammer Attrition Flow
• Figure 5: Most common words sent by scammer