Anansi: Scalable Characterization of Message-Based Job Scams

2026-02-27

AI Summary

This study addresses the lack of systematic and scalable monitoring approaches for job-based smishing—SMS scams masquerading as remote employment opportunities. We present the first end-to-end automated measurement framework that integrates large language models, automated browser agents, and infrastructure fingerprinting to actively engage with scammers and collect data at scale. Analyzing over 1,900 scam entities and more than 29,000 messages, our work uncovers previously undocumented operational mechanisms, including template reuse, domain impersonation, and cryptocurrency-based money laundering. We quantify potential financial losses in the millions of dollars and provide a comprehensive characterization of the social engineering tactics and brand impersonation strategies employed by these scams.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Application Domains: Misinformation & Fake News
• Natural Language Processing: Fact-Checking / Misinformation Detection (NLP Focus)

Application Category

• Economics, Online Markets and Human Computation: LLM based quality controls for crowd work
• Security and Privacy: Large-scale security measurements
• Web Mining and Content Analysis: Large pretrained models with web data

Abstract

Job-based smishing scams, where victims are recruited under the guise of remote job opportunities, represent a rapidly growing and understudied threat within the broader landscape of online fraud. In this paper, we present Anansi, the first scalable, end-to-end measurement pipeline designed to systematically engage with, analyze, and characterize job scams in the wild. Anansi combines large language models (LLMs), automated browser agents, and infrastructure fingerprinting tools to collect over 29,000 scam messages, interact with more than 1900 scammers, and extract behavioral, financial, and infrastructural signals at scale. We detail the operational workflows of scammers, uncover extensive reuse of message templates, domains, and cryptocurrency wallets, and identify the social engineering tactics used to defraud victims. Our analysis reveals millions of dollars in cryptocurrency losses, highlighting the use of deceptive techniques such as domain fronting and impersonation of well-known brands. Anansi demonstrates the feasibility and value of automating the engagement with scammers and the analysis of infrastructure, offering a new methodological foundation for studying large-scale fraud ecosystems.

Problem

• job-based smishing scams
• online fraud
• message-based scams
• cyber deception
• fraud characterization

Innovation

• scalable measurement
• job scam characterization
• large language models
• automated browser agents
• infrastructure fingerprinting