← 研踪 PaperTrailarXiv:2611.15394 · v1
Tracking What Works: Social Engineering Lures as Signatures for Victim-Centric Infostealer Campaign Discovery
首次提交 2026-11-11 20:16
版本更新 2026-11-11 20:16
雷达观测 2026-11-13 11:11
摘要
Despite advances in antivirus technology, infostealer infections persist at scale, driven primarily by social engineering rather than exploits. Yet, existing campaign detection efforts have focused on technical artifacts, overlooking the social-engineering lures exploiting human behavior and driving successful infections. To address this gap, we introduce a dual-framework system that discovers and tracks infostealer campaigns using victim-side artifacts from stealer logs. By treating social engineering lures as campaign signatures, the framework automatically aggregates individual infections into high-fidelity campaigns in near real-time. Recognizing distinct patterns between software and gaming ecosystems, we developed ecosystem-specific pipelines detecting all large and medium campaigns in both ecosystems (one medium gaming campaign was only recovered merged with another), though performance decreased for small campaigns. Analysis of 177 real-world campaigns identified by our framework reveals distinct temporal and infrastructure patterns with direct remediation implications. Software campaigns accumulate over 60% of infections within the first ten days, demanding rapid intervention following detection, while gaming campaigns grow more intense the longer they last, requiring continuous monitoring. Using social engineering lures as campaign signatures provides robustness to infrastructure fragmentation where traditional IoC-based detection fails. This work shifts campaign tracking from infrastructure correlation to victim-centric analysis, capturing why campaigns succeed rather than only how they operate, enabling awareness-driven prevention that addresses the human decision-making dimension absent from existing research.
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v1 · 2026-11-11 20:16 · 最新观测版本
Tracking What Works: Social Engineering Lures as Signatures for Victim-Centric Infostealer Campaign Discovery
Despite advances in antivirus technology, infostealer infections persist at scale, driven primarily by social engineering rather than exploits. Yet, existing campaign detection efforts have focused on technical artifacts, overlooking the social-engineering lures exploiting human behavior and driving successful infections. To address this gap, we introduce a dual-framework system that discovers and tracks infostealer campaigns using victim-side artifacts from stealer logs. By treating social engineering lures as campaign signatures, the framework automatically aggregates individual infections into high-fidelity campaigns in near real-time. Recognizing distinct patterns between software and gaming ecosystems, we developed ecosystem-specific pipelines detecting all large and medium campaigns in both ecosystems (one medium gaming campaign was only recovered merged with another), though performance decreased for small campaigns. Analysis of 177 real-world campaigns identified by our framework reveals distinct temporal and infrastructure patterns with direct remediation implications. Software campaigns accumulate over 60% of infections within the first ten days, demanding rapid intervention following detection, while gaming campaigns grow more intense the longer they last, requiring continuous monitoring. Using social engineering lures as campaign signatures provides robustness to infrastructure fragmentation where traditional IoC-based detection fails. This work shifts campaign tracking from infrastructure correlation to victim-centric analysis, capturing why campaigns succeed rather than only how they operate, enabling awareness-driven prevention that addresses the human decision-making dimension absent from existing research.
查看此版本解读 →查看此版本原文 ↗