Cybercrime and Law Enforcement Studies

Neueste Paper

• Using Codebooks to Detect Cybercrime Topics in Text Narratives

  Shufan Chai, Liangliang Sun, Jessica Staddon · 16. September 2026

  In the United States, management of cybercrime-related consumer complaints increasingly falls on state and city governments given de-staffing of federal agencies. AI, and in particular, large language models (LLMs), shows promise for detecting cybercrime in text complaints, but often via specialized…

• Beyond the Prank: The Hidden Expertise of TSS Scambaiters

  Saleh Alsyefi, Anish Chand, Matthew Edwards, Phani Vadrevu · 9. September 2026

  This research studies how Technical Support Scams (TSS) are being countered by a uniquely dedicated community of volunteer counter-fraud operatives. Using a careful subject selection strategy, we interviewed 17 individuals who actively engage in TSS scambaiting activities in order to obtain insight …

• Effective Interventions Against AI-Enhanced Scams

  Kyle Fredrickson · 2. September 2026

  In 2025, scams were responsible for an estimated $442 billion in direct losses globally. In the United States, reported losses increased by nearly 400% between 2020 and 2025. Though AI in scamming is a relatively new phenomenon, its use significantly changes the economics of scams as well as the bot…

• Retrieval-Constrained Policy Optimization for Attack Technique Extraction from Cyber Threat Intelligence

  Jiayun Zhang, Junshen Xu, Zejun Xie, Yi Fan · 10. August 2026

  Mapping cyber threat intelligence (CTI) text to MITRE ATT&CK techniques is essential for structured threat analysis, yet manual annotation is costly and does not scale. The ATT&CK taxonomy comprises several hundred attack techniques, and a single CTI passage may describe multiple techniques, making …

• Neutralizing Structural Inequality in the Nigerian FinTech Sector

  Muhammad Abdullahi Said · 14. Juli 2026

  Algorithmic decision systems in financial services often rely on data proxies that inadvertently encode structural inequalities. This paper introduces a hierarchical human-AI triage model for Point of Sale fraud detection in the Nigerian FinTech sector. Adopting a We Are All Equal worldview, we addr…

• Understanding Interpretation Difficulty in Harmful Online Communication: Insights from Cybercrime Communities

  Tomohiro Okatsu, Naoki Takada, Yin Min Pa Pa, Katsunari Yoshioka, Tatsunori Mori · 9. Juli 2026

  Harmful online communication often contains slang, coded terms, abbreviations, and community-specific expressions, which make messages difficult to interpret. This paper presents an exploratory study of interpretation difficulty in Discord chats related to cybercrime. We construct reference interpre…

• Cybercrime Victimization Among Young Adult Males Aged 18--20: A Post-Pandemic Analysis of Converging Risk Factors

  Anveeksh Mahesh Rao · 7. Juli 2026

  Cybercrime victimization among young adult males aged 18--20 has become an increasingly urgent public safety concern in the post-pandemic digital environment. From 2022 to 2024, individuals aged 20--29 submitted 191,787 complaints to the FBI Internet Crime Complaint Center (IC3), reporting combined …

• Inside Crypter-as-a-Service: An Ecosystem Analysis of the exploit.in Underground Forum Research Talks

  Mathieu Jeannot (UL, CNRS, LORIA), Jean-Yves Marion (LORIA, UL, CNRS), Manon Pamar (LORIA, UL, CNRS), Maira Nassau (LORIA, UL, CNRS), Pierre Marty (LORIA, UL, CNRS), Romain Guittienne (LORIA, UL, CNRS) · 24. Juni 2026

  Crypter-as-a-Service (CraaS) has become a key enabling layer of the contemporary malware economy by providing on-demand evasion capabilities through underground service markets. In this paper, we present a longitudinal characterization of the CraaS ecosystem on exploit.in, a major Russian-language c…

• CTIConnect: A Benchmark for Retrieval-Augmented LLMs over Heterogeneous Cyber Threat Intelligence

  Yutong Cheng, Yang Liu, Changze Li, Dawn Song, Peng Gao · 5. Juni 2026

  Cyber Threat Intelligence (CTI) is foundational to modern cybersecurity, enabling organizations to proactively defend against evolving threats. However, the sheer volume and heterogeneity of CTI data, spanning structured knowledge bases (CVE, CWE, CAPEC, MITRE ATT&CK) and unstructured threat reports…

• An LLM-based Chain-of-Response Counter-Scam System

  Heedou Kim, Mogan Gim, Donghee Choi, Hoonick Lee, Soonil Bae, Mi-Young Kim, Jaewoo Kang · 2. Juni 2026

  The rapid evolution of online scams, driven by transnational networks and mass produced social engineering scenarios, has exposed the speed limitations of conventional detection, necessitating tighter interagency coordination. While LLMs show promise in scam identification, their role in acceleratin…

• Connecting online criminal behavior with machine learning: Using authorship attribution to analyze and link potential online traffickers

  Vageesh Kumar Saxena · 7. Mai 2026

  This research investigated how online criminal activities can be better understood and connected using data-driven machine learning methods. Many illegal activities, such as human trafficking and illicit trade, have moved to online platforms where offenders hide behind anonymous accounts and frequen…

• TIJERE: A Novel Threat Intelligence Joint Extraction Model Based on Analyst Expert Knowledge

  Inoussa Mouiche, Sherif Saad · 5. Mai 2026

  The extraction of entities and relationships from threat intelligence reports into structured formats, such as cybersecurity knowledge graphs, is essential for automated threat analysis, detection, and mitigation. However, existing joint extraction methods struggle with feature confusion, language a…

• Love, Lies, and Language Models: Investigating AI's Role in Romance-Baiting Scams

  Gilad Gressel, Rahul Pankajakshan, Shir Rozenfeld, Ling Li, Ivan Franceschini, Krishnashree Achuthan, Yisroel Mirsky · 21. April 2026

  Romance-baiting scams have become a major source of financial and emotional harm worldwide. These operations are run by organized crime syndicates that traffic thousands of people into forced labor, requiring them to build emotional intimacy with victims over weeks of text conversations before press…

• Characterizing Resource Sharing Practices on Underground Internet Forum Synthetic Non-Consensual Intimate Image Content Creation Communities

  Bernardo B. P. Medeiros (University of Florida), Malvika Jadhav (University of Florida), Allison Lu (University of Florida), Tadayoshi Kohno (Georgetown University), Vincent Bindschaedler (University of Florida), Kevin R. B. Butler (University of Florida) · 15. April 2026

  Many malicious actors responsible for disseminating synthetic non-consensual intimate imagery (SNCII) operate within internet forums to exchange resources, strategies, and generated content across multiple platforms. Technically-sophisticated actors gravitate toward certain communities (e.g., 4chan)…

• Stand-Alone Complex or Vibercrime? Exploring the adoption and innovation of GenAI tools, coding assistants, and agents within cybercrime ecosystems

  Jack Hughes, Ben Collier, Daniel R. Thomas · 1. April 2026

  Existential risk scenarios relating to Generative Artificial Intelligence often involve advanced systems or agentic models breaking loose and using hacking tools to gain control over critical infrastructure. In this paper, we argue that the real threats posed by generative AI for cybercrime are rath…

• LJ-Bench: Ontology-Based Benchmark for U.S. Crime

  Hung Yun Tseng, Wuzhen Li, Blerina Gkotse, Grigorios Chrysos · 24. März 2026

  The potential of Large Language Models (LLMs) to provide harmful information remains a significant concern due to the vast breadth of illegal queries they may encounter. Unfortunately, existing benchmarks only focus on a handful types of illegal activities, and are not grounded in legal works. In th…

• Global Cybercrime Damages: A Baseline for Frontier AI Risk Assessment

  Kamil\.e Luko\v{s}i\=ut\.e, John Halstead, Luca Righetti · 24. März 2026

  AI companies and governments are increasingly concerned about frontier AI systems enabling cybercrime, yet defining meaningful capability thresholds requires knowing the scale of cybercrime today. Current estimates of global cybercrime damages vary from tens of billions to tens of trillions of dolla…

• AttackSeqBench: Benchmarking the Capabilities of LLMs for Attack Sequences Understanding

  Haokai Ma, Javier Yong, Yunshan Ma, Kuei Chen, Anis Yusof, Zhenkai Liang, Ee-Chien Chang · 4. März 2026

  Cyber Threat Intelligence (CTI) reports document observations of cyber threats, synthesizing evidence about adversaries' actions and intent into actionable knowledge that informs detection, response, and defense planning. However, the unstructured and verbose nature of CTI reports poses significant …

• Assessing Crime Disclosure Patterns in a Large-Scale Cybercrime Forum

  Raphael Hoheisel, Tom Meurs, Jai Wientjes, Marianne Junger, Abhishta Abhishta, Masarah Paquet-Clouston · 3. März 2026

  Cybercrime forums play a central role in the cybercrime ecosystem, serving as hubs for the exchange of illicit goods, services, and knowledge. Previous studies have explored the market and social structures of these forums, but less is known about the behavioral dynamics of users, particularly regar…

• SocialHarmBench: Revealing LLM Vulnerabilities to Socially Harmful Requests

  Punya Syon Pandey, Hai Son Le, Devansh Bhardwaj, Rada Mihalcea, Zhijing Jin · 24. Februar 2026

  Large language models (LLMs) are increasingly deployed in contexts where their failures can have direct sociopolitical consequences. Yet, existing safety benchmarks rarely test vulnerabilities in domains such as political manipulation, propaganda and disinformation generation, or surveillance and in…

• What hackers talk about when they talk about AI: Early-stage diffusion of a cybercrime innovation

  Beno\^it Dupont, Chad Whelan, Serge-Olivier Paquette · 17. Februar 2026

  The rapid expansion of artificial intelligence (AI) is raising concerns about its potential to transform cybercrime. Beyond empowering novice offenders, AI stands to intensify the scale and sophistication of attacks by seasoned cybercriminals. This paper examines the evolving relationship between cy…

• Modeling Behavioral Signals in Job Scams: A Human-Centered Security Study

  Goni Anagha, Vishakha Dasi Agrawal, Gargi Sarkar, Kavita Vemuri, Sandeep Kumar Shukla · 28. Januar 2026

  Job scams have emerged as a rapidly growing form of cybercrime that manipulates human decision-making processes. Existing countermeasures primarily focus on scam typologies or post-loss indicators, offering limited support for early-stage intervention. In this study, we examine how behavioral decisi…

• Constructing Multi-label Hierarchical Classification Models for MITRE ATT&CK Text Tagging

  Andrew Crossman, Jonah Dodd, Viralam Ramamurthy Chaithanya Kumar, Riyaz Mohammed, Andrew R. Plummer, Chandra Sekharudu, Deepak Warrier, Mohammad Yekrangian · 22. Januar 2026

  MITRE ATT&CK is a cybersecurity knowledge base that organizes threat actor and cyber-attack information into a set of tactics describing the reasons and goals threat actors have for carrying out attacks, with each tactic having a set of techniques that describe the potential methods used in these at…

• Experiencer, Helper, or Observer: Online Fraud Intervention for Older Adults Through Role-based Simulation

  Yue Deng, Xiaowei Chen, Junxiang Liao, Bo Li, Yixin Zou · 21. Januar 2026

  Online fraud is a critical global threat that disproportionately targets older adults. Prior anti-fraud education for older adults has largely relied on static, traditional instruction that limits engagement and real-world transfer, whereas role-based simulation offers realistic yet low-risk opportu…

• SENTINEL: A Multi-Modal Early Detection Framework for Emerging Cyber Threats using Telegram

  Mohammad Hammas Saeed, Howie Huang · 29. Dezember 2025

  Cyberattacks pose a serious threat to modern sociotechnical systems, often resulting in severe technical and societal consequences. Attackers commonly target systems and infrastructure through methods such as malware, ransomware, or other forms of technical exploitation. Most traditional mechanisms …