APWG eCrime Symposium Announces Final Roll of Accepted Papers Clearing Review for This Year's eCrime Conference

APWG Symposium on Electronic Crime Research

CAMBRIDGE, MA, UNITED STATES, October 21, 2026 /EINPresswire.com/ -- The managing chairs of APWG’s 2026 Symposium on Electronic Crime Research (eCrime) today announce 13 accepted papers selected from more than 40 submissions to this year's APWG eCrime Symposium. Presented at eCrime 2026 Lisboa, alongside sessions featuring industry, law enforcement, NGOs and multilateral organizations, these papers will be published in IEEE Xplore, marking eCrime’s 19th year as an IEEE conference.

This year's accepted papers span phishing infrastructure, criminal economies, social engineering, human behavior, information manipulation, and AI-driven defenses. Together, they demonstrate why civilization-level responses require interdisciplinary research, shared cybercrime event ontologies, interoperable intelligence, and coordinated international institutions capable of understanding, predicting, and disrupting increasingly complex criminal ecosystems.

eCrime founder and APWG Secretary General Peter Cassidy said, "Rigorous research by eCrime investigators brings all stakeholders to the cybercrime frontier, framing provocative problem statements and focusing on overlooked solution spaces. In this, the beginning of our third decade we pause to recall eCrime's central contribution: convening members of all scientific disciplines and the larger global cybercrime research community essential to forging a civilization-level response to cybercrime, by building the shared knowledge, semantic foundations, and institutional commitments required to understand and counter cybercrime as a persistent, and fast-mutating global threat.”

Paper titles and principal authors with short abstracts follow. For questions or requests doe preprints, please contact: ecrime2026@apwg.org

1. PhishTrace: Characterizing Phishing Websites from Dynamic Features
Ridwan Arefin Islam — McGill University

PhishTrace detects sophisticated phishing through dynamic JavaScript behavioral analysis in an instrumented browser that simulates human interactions and monitors API calls. The research demonstrates the limitations of static detection, with F1-scores falling to 0.326 when dynamic features are removed.

2. Understanding the Security Impact of Blocklist-based Anti-phishing Intelligence Services in Practice
Kyungchan Lim — University of Maryland

A six-month comparative evaluation of Google Safe Browsing and competing phishing intelligence services identifies significant detection gaps. Evasive phishing websites frequently escape detection, while language-related disparities expose weaknesses in current blocklist coverage and effectiveness.

3. All the Pieces Matter! A Six-stage Analysis of an Underground Fraud Ecosystem on Dread
Megha Sundriyal — MPI-SP

This study dissects a functioning underground fraud economy into six interconnected stages: Capability, Data Acquisition, Technique Sharing, Identity Forgery, Execution and Extraction. It reveals how specialized criminal actors exchange tools, services and laundering capabilities throughout the fraud value chain.

4. A Tree-Structured Approach for Phishing Template and Attacker Attribution Analysis
Unai Agirre — Vicomtech

Researchers investigate phishing template reuse through structural analysis of HTML Document Object Model trees. Unsupervised clustering identifies related phishing pages and potentially coordinated campaigns, overcoming limitations of reactive blocklists and individual-site classification.

5. Visa-Related Online Help-Seeking and Digital Scam Exposure: A Cross-Platform Security Measurement
Hassan Alhassan — Indiana University Bloomington

Examining visa-related conversations across Reddit, YouTube and Telegram from 2018–2025, this study identifies opportunities for social engineering, misleading guidance and document exploitation. Researchers classify help-seeking behavior, exploitative responses and potentially hazardous links affecting vulnerable immigration-related communities.

6. “I'm in Boss. What Next?”: Characterizing the Telegram Scam Support Ecosystem
Allison Lu — University of Florida

Analyzing more than 12 million Telegram messages, researchers expose a decentralized marketplace supplying scammers with reusable infrastructure, operational resources and informal trust mechanisms. The findings illustrate how specialized support networks enable fraud campaigns to proliferate at scale.

7. Built to Last? Registration and DNS Strategies in Phishing Domain Survival
Kyungchan Lim — University of Maryland

Using APWG intelligence and six additional blocklists, researchers examine 850,000 phishing domains across 1,258 TLDs between July 2021 and April 2026. Significant differences in detection timing reveal how registration practices, registrars, target brands and infrastructure characteristics could support earlier interdiction.

8. The Promise of Strategic Agentic Scambaiting
Abhishek Satyam — Fordham University

A formal model of adversarial AI-agent interactions explores how autonomous defensive scambaiting can exhaust criminal resources and undermine scam profitability. Under modeled conditions, sufficient defensive-agent deployment makes scams unprofitable, potentially shifting the economics of AI-enabled fraud toward defenders.

9. Visibility-Aware HTML Analysis through Renderer-Level Extraction
Lucas Betts — University of Auckland

This research addresses malicious email content concealed through CSS and rendering manipulation. Extracting browser-renderer features produces interpretable concealment indicators, enabling scalable detection and prioritization without computationally expensive screenshot-based optical character recognition.

10. The “Allow” Reflex: Permission-Scope Misinterpretation as a Socio-Technical Exposure in Mobile Cybercrime
Lakshmi Kandagadla Srinivasamurthy — University of Washington

The study investigates how users misunderstand mobile application permissions involving sensitive resources such as cameras, microphones and location data. It demonstrates how formally authorized access may lack informed consent, creating exploitable opportunities for cybercriminals without conventional technical compromise.

11. Suspected Foreign Influence Activity in Korean News Discussions on YouTube
Hyeonseung Kim — Korea Advanced Institute of Science and Technology

Analyzing 67 million comments from two million users across 296,000 Korean news videos, researchers investigate suspected foreign influence activity during political upheaval. Findings reveal how state-aligned narratives can diffuse through discussion networks and reshape surrounding civic discourse.

12. Read This Paper to Get $50 Million: An Analysis of Mobile Messaging Scams Using Reddit Data
Allison Lu — University of Florida

Using Reddit-reported mobile messaging scams, researchers characterize campaign patterns and evaluate commercial and open-source detection tools. Reply-dependent scams prove particularly difficult to detect, exposing substantial shortcomings in existing defenses despite recurring textual and telephone-number characteristics.

13. PasteJacked: Detection and Characterization of Clipboard-Hijacking Attacks
Mohamed Nabeel — Palo Alto Networks

Researchers develop a two-stage detection system combining clipboard-command signatures with agentic investigation of suspicious webpages. Analysis of 31,868 lure URLs over approximately 90 days demonstrates the advantages of layered behavioral detection and the short operational lifespan of conventional indicators of compromise.

Aimee Larsen Kirkpatrick
APWG
+1 808-282-9850
Visit us on social media:
LinkedIn
Facebook
X