{"id":"https://openalex.org/W4415222234","doi":"https://doi.org/10.1145/3730567.3732922","title":"Do Spammers Dream of Electric Sheep? Characterizing the Prevalence of LLM-Generated Malicious Emails","display_name":"Do Spammers Dream of Electric Sheep? Characterizing the Prevalence of LLM-Generated Malicious Emails","publication_year":2025,"publication_date":"2025-10-15","ids":{"openalex":"https://openalex.org/W4415222234","doi":"https://doi.org/10.1145/3730567.3732922"},"language":"en","primary_location":{"id":"doi:10.1145/3730567.3732922","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3730567.3732922","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3730567.3732922","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM Internet Measurement Conference","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3730567.3732922","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5116178294","display_name":"Wei Hao","orcid":"https://orcid.org/0009-0000-8575-2540"},"institutions":[{"id":"https://openalex.org/I4210125482","display_name":"Clinical Directors Network","ror":"https://ror.org/031acn267","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I4210125482"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Wei Hao","raw_affiliation_strings":["Columbia University, New York, USA and Barracuda Networks, Campbell, USA"],"raw_orcid":"https://orcid.org/0009-0000-8575-2540","affiliations":[{"raw_affiliation_string":"Columbia University, New York, USA and Barracuda Networks, Campbell, USA","institution_ids":["https://openalex.org/I4210125482"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101552299","display_name":"Van Tran","orcid":"https://orcid.org/0000-0002-0835-8598"},"institutions":[{"id":"https://openalex.org/I40347166","display_name":"University of Chicago","ror":"https://ror.org/024mw5h28","country_code":"US","type":"education","lineage":["https://openalex.org/I40347166"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Van Tran","raw_affiliation_strings":["University of Chicago, Chicago, USA"],"raw_orcid":"https://orcid.org/0000-0002-0835-8598","affiliations":[{"raw_affiliation_string":"University of Chicago, Chicago, USA","institution_ids":["https://openalex.org/I40347166"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120013470","display_name":"Vincent Rideout","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Vincent Rideout","raw_affiliation_strings":["Barracuda Networks, Campbell, USA"],"raw_orcid":"https://orcid.org/0009-0004-9775-3283","affiliations":[{"raw_affiliation_string":"Barracuda Networks, Campbell, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5111243400","display_name":"Zixi Wang","orcid":"https://orcid.org/0009-0008-5551-577X"},"institutions":[{"id":"https://openalex.org/I4210125482","display_name":"Clinical Directors Network","ror":"https://ror.org/031acn267","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I4210125482"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zixi Wang","raw_affiliation_strings":["Columbia University, New York, USA and Barracuda Networks, Campbell, USA"],"raw_orcid":"https://orcid.org/0009-0008-5551-577X","affiliations":[{"raw_affiliation_string":"Columbia University, New York, USA and Barracuda Networks, Campbell, USA","institution_ids":["https://openalex.org/I4210125482"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5093252600","display_name":"AnMei Dasbach-Prisk","orcid":"https://orcid.org/0009-0007-9989-0822"},"institutions":[{"id":"https://openalex.org/I36258959","display_name":"University of California San Diego","ror":"https://ror.org/0168r3w48","country_code":"US","type":"education","lineage":["https://openalex.org/I36258959"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"AnMei Dasbach-Prisk","raw_affiliation_strings":["University of California San Diego, San Diego, USA"],"raw_orcid":"https://orcid.org/0009-0007-9989-0822","affiliations":[{"raw_affiliation_string":"University of California San Diego, San Diego, USA","institution_ids":["https://openalex.org/I36258959"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5020888623","display_name":"M. H. Afifi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"M. H. Afifi","raw_affiliation_strings":["Barracuda Networks, Campbell, USA"],"raw_orcid":"https://orcid.org/0000-0002-6492-7775","affiliations":[{"raw_affiliation_string":"Barracuda Networks, Campbell, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008303237","display_name":"Junfeng Yang","orcid":"https://orcid.org/0009-0000-2277-6545"},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Junfeng Yang","raw_affiliation_strings":["Columbia University, New York, USA"],"raw_orcid":"https://orcid.org/0009-0000-2277-6545","affiliations":[{"raw_affiliation_string":"Columbia University, New York, USA","institution_ids":["https://openalex.org/I78577930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5045165255","display_name":"Ethan Katz-Bassett","orcid":"https://orcid.org/0000-0002-1030-6391"},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ethan Katz-Bassett","raw_affiliation_strings":["Columbia University, New York, USA"],"raw_orcid":"https://orcid.org/0000-0002-1030-6391","affiliations":[{"raw_affiliation_string":"Columbia University, New York, USA","institution_ids":["https://openalex.org/I78577930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5093406308","display_name":"Grant Ho","orcid":"https://orcid.org/0009-0002-4216-951X"},"institutions":[{"id":"https://openalex.org/I40347166","display_name":"University of Chicago","ror":"https://ror.org/024mw5h28","country_code":"US","type":"education","lineage":["https://openalex.org/I40347166"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Grant Ho","raw_affiliation_strings":["University of Chicago, Chicago, USA"],"raw_orcid":"https://orcid.org/0009-0002-4216-951X","affiliations":[{"raw_affiliation_string":"University of Chicago, Chicago, USA","institution_ids":["https://openalex.org/I40347166"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5032570570","display_name":"Asaf Cidon","orcid":"https://orcid.org/0009-0007-4046-2022"},"institutions":[{"id":"https://openalex.org/I4210125482","display_name":"Clinical Directors Network","ror":"https://ror.org/031acn267","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I4210125482"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Asaf Cidon","raw_affiliation_strings":["Columbia University, New York, USA and Barracuda Networks, Campbell, USA"],"raw_orcid":"https://orcid.org/0009-0007-4046-2022","affiliations":[{"raw_affiliation_string":"Columbia University, New York, USA and Barracuda Networks, Campbell, USA","institution_ids":["https://openalex.org/I4210125482"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.9052,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":{"value":0.87354362,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"192","last_page":"203"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.998199999332428,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/dream","display_name":"Dream","score":0.33820000290870667},{"id":"https://openalex.org/keywords/spamming","display_name":"Spamming","score":0.2802000045776367},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.2768000066280365},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.24969999492168427}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5202000141143799},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.492000013589859},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.4311000108718872},{"id":"https://openalex.org/C2781095916","wikidata":"https://www.wikidata.org/wiki/Q36348","display_name":"Dream","level":2,"score":0.33820000290870667},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.2906999886035919},{"id":"https://openalex.org/C158955206","wikidata":"https://www.wikidata.org/wiki/Q83058","display_name":"Spamming","level":3,"score":0.2802000045776367},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.2768000066280365},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2500999867916107},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.24969999492168427},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.24619999527931213}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3730567.3732922","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3730567.3732922","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3730567.3732922","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM Internet Measurement Conference","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3730567.3732922","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3730567.3732922","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3730567.3732922","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM Internet Measurement Conference","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1438972881","display_name":"Collaborative Research: NeTS: Medium: Scalable Crawling of the Web as Experienced by Users","funder_award_id":"2403431","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4415222234.pdf","grobid_xml":"https://content.openalex.org/works/W4415222234.grobid-xml"},"referenced_works_count":9,"referenced_works":["https://openalex.org/W2053154970","https://openalex.org/W2347140731","https://openalex.org/W3101891351","https://openalex.org/W4231510805","https://openalex.org/W4237082168","https://openalex.org/W4249672879","https://openalex.org/W4389736946","https://openalex.org/W4399412887","https://openalex.org/W4401042451"],"related_works":[],"abstract_inverted_index":{"The":[0],"rapid":[1],"adoption":[2],"of":[3,32,42,72,80,87,89,91,129,164,172,186],"large":[4],"language":[5],"models":[6],"(LLMs)":[7],"has":[8,27],"fueled":[9],"speculation":[10],"that":[11,179],"cybercriminals":[12],"may":[13],"utilize":[14],"LLMs":[15,73,187],"to":[16,76,126,188],"improve":[17],"and":[18,53,151],"automate":[19],"their":[20,184],"attacks.However,":[21],"so":[22],"far,":[23],"the":[24,40,58,70,78,127,170],"security":[25],"community":[26],"had":[28],"only":[29],"anecdotal":[30],"evidence":[31],"attackers":[33,75,180],"using":[34],"LLMs,":[35],"lacking":[36],"large-scale":[37,60],"data":[38],"on":[39,69,148],"extent":[41],"real-world":[43,92],"malicious":[44,81,93],"LLM":[45,116,145],"usage.In":[46],"this":[47,101,120,139],"joint":[48],"work":[49],"between":[50],"academic":[51],"researchers":[52],"Barracuda":[54],"Networks,":[55],"we":[56,67,107,122,141,167],"present":[57],"first":[59],"study":[61],"measuring":[62],"AIgenerated":[63],"attacks":[64],"in-the-wild.In":[65],"particular,":[66],"focus":[68],"use":[71,185],"by":[74,83,96],"craft":[77],"text":[79,132],"emails":[82,94,166],"analyzing":[84],"a":[85,161],"corpus":[86,150],"hundreds":[88],"thousands":[90],"detected":[95],"Barracuda.The":[97],"key":[98],"challenge":[99],"in":[100],"analysis":[102],"is":[103,115],"determining":[104],"ground":[105],"truth:":[106],"cannot":[108],"know":[109],"for":[110],"certain":[111],"whether":[112],"an":[113],"email":[114,131],"or":[117],"human-generated.To":[118],"overcome":[119],"challenge,":[121],"observe":[123],"that,":[124],"prior":[125],"launch":[128,171],"ChatGPT,":[130,173],"was":[133],"almost":[134],"certainly":[135],"not":[136],"LLM-generated.Armed":[137],"with":[138],"insight,":[140],"run":[142],"three":[143,175],"state-of-the-art":[144],"detection":[146,176],"methods":[147,177],"our":[149],"calibrate":[152],"them":[153],"against":[154,160],"pre-ChatGPT":[155],"emails,":[156],"as":[157,159],"well":[158],"diverse":[162],"set":[163],"LLM-generated":[165],"create":[168],"ourselves.Since":[169],"all":[174],"indicate":[178],"have":[181],"steadily":[182],"increased":[183],"*":[189],"Work":[190],"done":[191],"at":[192],"Columbia":[193],"University.":[194]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-31T08:31:51.225901","created_date":"2025-10-16T00:00:00"}