{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,25]],"date-time":"2026-08-25T02:59:51Z","timestamp":1787626791695,"version":"build-2736575974"},"publisher-location":"New York, NY, USA","reference-count":33,"publisher":"ACM","license":[{"start":{"date-parts":[[2019,5,13]],"date-time":"2019-05-13T00:00:00Z","timestamp":1557705600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2019,5,13]]},"DOI":"10.1145\/3308558.3313489","type":"proceedings-article","created":{"date-parts":[[2019,5,13]],"date-time":"2019-05-13T12:17:59Z","timestamp":1557749879000},"page":"1279-1289","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":28,"title":["Hack for Hire: Exploring the Emerging Market for Account Hijacking"],"prefix":"10.1145","author":[{"given":"Ariana","family":"Mirian","sequence":"first","affiliation":[{"name":"University of California San Diego, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Joe","family":"DeBlasio","sequence":"additional","affiliation":[{"name":"University of California San Diego, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Stefan","family":"Savage","sequence":"additional","affiliation":[{"name":"University of California San Diego, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Geoffrey M.","family":"Voelker","sequence":"additional","affiliation":[{"name":"University of California San Diego, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kurt","family":"Thomas","sequence":"additional","affiliation":[{"name":"Google, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2019,5,13]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"November","author":"Anise Olabode","year":"2017","unstructured":"Olabode Anise and Kyle Lady . State of the Auth: Experiences and Perceptions of Multi-Factor Authentication. Duo Security, https:\/\/duo.com\/assets\/ebooks\/state-of-the-auth.pdf , November 2017 . Accessed : 2018-10-22. Olabode Anise and Kyle Lady. State of the Auth: Experiences and Perceptions of Multi-Factor Authentication. Duo Security, https:\/\/duo.com\/assets\/ebooks\/state-of-the-auth.pdf, November 2017. Accessed: 2018-10-22."},{"key":"e_1_3_2_1_2_1","volume-title":"Stefan Savage. Handcrafted Fraud and Extortion: Manual Account Hijacking in the Wild. In Proceedings of the 2014 ACM Internet Measurement Conference (IMC)","author":"Bursztein Elie","year":"2014","unstructured":"Elie Bursztein , Borbala Benko , Daniel Margolis , Tadek Pietraszek , Andy Archer , Allan Aquino , Andreas Pitsillidis , and Stefan Savage. Handcrafted Fraud and Extortion: Manual Account Hijacking in the Wild. In Proceedings of the 2014 ACM Internet Measurement Conference (IMC) , Vancouver, BC, Canada , November 2014 . Elie Bursztein, Borbala Benko, Daniel Margolis, Tadek Pietraszek, Andy Archer, Allan Aquino, Andreas Pitsillidis, and Stefan Savage. Handcrafted Fraud and Extortion: Manual Account Hijacking in the Wild. In Proceedings of the 2014 ACM Internet Measurement Conference (IMC), Vancouver, BC, Canada, November 2014."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/2663716.2663729"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/1357054.1357219"},{"key":"e_1_3_2_1_5_1","unstructured":"Enron Email Dataset. https:\/\/www.cs.cmu.edu\/~enron\/. Accessed: 2018-11-03.  Enron Email Dataset. https:\/\/www.cs.cmu.edu\/~enron\/. Accessed: 2018-11-03."},{"key":"e_1_3_2_1_6_1","unstructured":"Evilginx -- Advanced Phishing with Two-factor Authentication Bypass. https:\/\/breakdev.org\/evilginx-advanced-phishing-with-two-factor-authentication-bypass\/. Accessed: 2018-10-22.  Evilginx -- Advanced Phishing with Two-factor Authentication Bypass. https:\/\/breakdev.org\/evilginx-advanced-phishing-with-two-factor-authentication-bypass\/. Accessed: 2018-10-22."},{"key":"e_1_3_2_1_7_1","unstructured":"Google. Add 2-Step Verification. https:\/\/support.google.com\/a\/answer\/175197. Accessed: 2018-10-22.  Google. Add 2-Step Verification. https:\/\/support.google.com\/a\/answer\/175197. Accessed: 2018-10-22."},{"key":"e_1_3_2_1_8_1","unstructured":"Google. Guard Against Targeted Attacks. https:\/\/support.google.com\/a\/answer\/9010419. Accessed: 2018-10-22.  Google. Guard Against Targeted Attacks. https:\/\/support.google.com\/a\/answer\/9010419. Accessed: 2018-10-22."},{"key":"e_1_3_2_1_9_1","unstructured":"Google. Verify a user's identity with a login challenge. https:\/\/support.google.com\/a\/answer\/6002699. Accessed: 2018-10-22.  Google. Verify a user's identity with a login challenge. https:\/\/support.google.com\/a\/answer\/6002699. Accessed: 2018-10-22."},{"key":"e_1_3_2_1_10_1","unstructured":"Garrett M. Graff. DOJ Indicts 9 Iranians For Brazen Cyberattacks Against 144 US Universities. Wired https:\/\/www.wired.com\/story\/iran-cyberattacks-us-universities-indictment\/. Accessed: 2018-10-22.  Garrett M. Graff. DOJ Indicts 9 Iranians For Brazen Cyberattacks Against 144 US Universities. Wired https:\/\/www.wired.com\/story\/iran-cyberattacks-us-universities-indictment\/. Accessed: 2018-10-22."},{"key":"e_1_3_2_1_11_1","volume-title":"Voelker. Manufacturing Compromise: The Emergence of Exploit-as-a-Service. In Proceedings of the ACM Conference on Computer and Communications Security","author":"Grier Chris","year":"2012","unstructured":"Chris Grier , Lucas Ballard , Juan Caballero , Neha Chachra a \u00f1d Christian J. Dietrich , Kirill Levchenko , Panayiotis Mavrommatis , Da mon McCoy , Antonio Nappa , Andreas Pitsillidis , Niels Provos , M. Zub air Rafique, Moheeb Abu Rajab, Christian Rossow, Kurt Thomas, Vern Paxson, Stefan Savage, and Geoffrey M . Voelker. Manufacturing Compromise: The Emergence of Exploit-as-a-Service. In Proceedings of the ACM Conference on Computer and Communications Security , Raleigh, NC , October 2012 . Chris Grier, Lucas Ballard, Juan Caballero, Neha Chachra a\u00f1d Christian J. Dietrich, Kirill Levchenko, Panayiotis Mavrommatis, Da mon McCoy, Antonio Nappa, Andreas Pitsillidis, Niels Provos, M. Zub air Rafique, Moheeb Abu Rajab, Christian Rossow, Kurt Thomas, Vern Paxson, Stefan Savage, and Geoffrey M. Voelker. Manufacturing Compromise: The Emergence of Exploit-as-a-Service. In Proceedings of the ACM Conference on Computer and Communications Security, Raleigh, NC, October 2012."},{"key":"e_1_3_2_1_12_1","volume-title":"Ronald J Deibert. Targeted Threat Index: Characterizing and Quantifying Politically-Motivated Targeted Malware. In Proceedings of the 23rd USENIX Security Symposium","author":"Hardy Seth","year":"2014","unstructured":"Seth Hardy , Masashi Crete-Nishihata , Katharine Kleemola , Adam Senft , Byron Sonne , Greg Wiseman , Phillipa Gill , and Ronald J Deibert. Targeted Threat Index: Characterizing and Quantifying Politically-Motivated Targeted Malware. In Proceedings of the 23rd USENIX Security Symposium , San Diego, CA, USA , August 2014 . Seth Hardy, Masashi Crete-Nishihata, Katharine Kleemola, Adam Senft, Byron Sonne, Greg Wiseman, Phillipa Gill, and Ronald J Deibert. Targeted Threat Index: Characterizing and Quantifying Politically-Motivated Targeted Malware. In Proceedings of the 23rd USENIX Security Symposium, San Diego, CA, USA, August 2014."},{"key":"e_1_3_2_1_13_1","volume-title":"January","author":"Karambelas Ian","year":"2016","unstructured":"Ian Karambelas . Spear Phishing: The Secret Weapon Behind the Worst Cyber Attacks. Cloudmark, https:\/\/blog.cloudmark.com\/2016\/01\/13\/spear-phishing-secret-weapon-in-worst-cyber-attacks\/ , January 2016 . Accessed : 2018-10-22. Ian Karambelas. Spear Phishing: The Secret Weapon Behind the Worst Cyber Attacks. Cloudmark, https:\/\/blog.cloudmark.com\/2016\/01\/13\/spear-phishing-secret-weapon-in-worst-cyber-attacks\/, January 2016. Accessed: 2018-10-22."},{"key":"e_1_3_2_1_14_1","volume-title":"Manos Antonakakis. Hiding in Plain Sight: A Longitudinal Study of Combosquatting Abuse. In Proceedings of the 2017 ACM Conference on Computer and Communications Security (CCS)","author":"Kintis Panagiotis","year":"2017","unstructured":"Panagiotis Kintis , Najmeh Miramirkhani , Charles Lever , Yizheng Chen , Roza Romero-Go?ez, Nikolaos Pitropakis , Nick Nikiforakis , and Manos Antonakakis. Hiding in Plain Sight: A Longitudinal Study of Combosquatting Abuse. In Proceedings of the 2017 ACM Conference on Computer and Communications Security (CCS) , Dallas, TX, USA , October 2017 . Panagiotis Kintis, Najmeh Miramirkhani, Charles Lever, Yizheng Chen, Roza Romero-Go?ez, Nikolaos Pitropakis, Nick Nikiforakis, and Manos Antonakakis. Hiding in Plain Sight: A Longitudinal Study of Combosquatting Abuse. In Proceedings of the 2017 ACM Conference on Computer and Communications Security (CCS), Dallas, TX, USA, October 2017."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/1240624.1240760"},{"key":"e_1_3_2_1_16_1","volume-title":"Proceedings of the 23rd USENIX Security Symposium","author":"Blond Stevens Le","year":"2014","unstructured":"Stevens Le Blond , Adina Uritesc , C\u00e9dric Gilbert , Zheng Leong Chua , Prateek Saxena , and Engin Kirda . A Look at Targeted Attacks Through the Lense of an NGO . In Proceedings of the 23rd USENIX Security Symposium , San Diego, CA, USA , August 2014 . Stevens Le Blond, Adina Uritesc, C\u00e9dric Gilbert, Zheng Leong Chua, Prateek Saxena, and Engin Kirda. A Look at Targeted Attacks Through the Lense of an NGO. In Proceedings of the 23rd USENIX Security Symposium, San Diego, CA, USA, August 2014."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/2815675.2815693"},{"key":"e_1_3_2_1_18_1","volume-title":"Marczak and Vern Paxson. Social Engineering Attacks on Government Opponents: Target Perspectives. In Proceedings of the 17th Privacy Enhancing Technologies Symposium (PETS)","author":"William","year":"2017","unstructured":"William R Marczak and Vern Paxson. Social Engineering Attacks on Government Opponents: Target Perspectives. In Proceedings of the 17th Privacy Enhancing Technologies Symposium (PETS) , Minneapolis, MN, USA , July 2017 . William R Marczak and Vern Paxson. Social Engineering Attacks on Government Opponents: Target Perspectives. In Proceedings of the 17th Privacy Enhancing Technologies Symposium (PETS), Minneapolis, MN, USA, July 2017."},{"key":"e_1_3_2_1_19_1","volume-title":"Proceedings of the 23rd USENIX Security Symposium","author":"Marczak William R","year":"2014","unstructured":"William R Marczak , John Scott-Railton , Morgan Marquis-Boire , and Vern Paxson . When Governments Hack Opponents: A Look at Actors and Technology . In Proceedings of the 23rd USENIX Security Symposium , San Diego, CA, USA , August 2014 . William R Marczak, John Scott-Railton, Morgan Marquis-Boire, and Vern Paxson. When Governments Hack Opponents: A Look at Actors and Technology. In Proceedings of the 23rd USENIX Security Symposium, San Diego, CA, USA, August 2014."},{"key":"e_1_3_2_1_20_1","volume-title":"January","author":"Milka Grzegorz","year":"2018","unstructured":"Grzegorz Milka . Anatomy of Account Takeover. Enigma, https:\/\/www.usenix.org\/node\/208154 , January 2018 . Grzegorz Milka. Anatomy of Account Takeover. Enigma, https:\/\/www.usenix.org\/node\/208154, January 2018."},{"key":"e_1_3_2_1_21_1","volume-title":"Proceedings of the 19th USENIX Security Symposium","author":"Motoyama Marti","year":"2010","unstructured":"Marti Motoyama , Kirill Levchenko , Chris Kanich , Damon McCoy , Geoffrey M. Voelker , and Stefan Savage . Re : CAPTCHAs: Understanding CAPTCHA-solving Services in an Economic Context . In Proceedings of the 19th USENIX Security Symposium , Washington, DC, USA , August 2010 . Marti Motoyama, Kirill Levchenko, Chris Kanich, Damon McCoy, Geoffrey M. Voelker, and Stefan Savage. Re: CAPTCHAs: Understanding CAPTCHA-solving Services in an Economic Context. In Proceedings of the 19th USENIX Security Symposium, Washington, DC, USA, August 2010."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/ECRIME.2018.8376206"},{"key":"e_1_3_2_1_23_1","volume-title":"Gianluca Stringhini. What Happens After You Are Pwnd: Understanding the Use of Leaked Webmail Credentials in the Wild. In Proceedings of the 2016 ACM Internet Measurement Conference (IMC)","author":"Onaolapo Jeremiah","year":"2016","unstructured":"Jeremiah Onaolapo , Enrico Mariconti , and Gianluca Stringhini. What Happens After You Are Pwnd: Understanding the Use of Leaked Webmail Credentials in the Wild. In Proceedings of the 2016 ACM Internet Measurement Conference (IMC) , Santa Monica, CA, USA , November 2016 . Jeremiah Onaolapo, Enrico Mariconti, and Gianluca Stringhini. What Happens After You Are Pwnd: Understanding the Use of Leaked Webmail Credentials in the Wild. In Proceedings of the 2016 ACM Internet Measurement Conference (IMC), Santa Monica, CA, USA, November 2016."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/1753326.1753383"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/1280680.1280692"},{"key":"e_1_3_2_1_26_1","volume-title":"October","author":"Skelker Jonathan","year":"2018","unstructured":"Jonathan Skelker . Announcing some security treats to protect you from attackers' tricks. https:\/\/security.googleblog.com\/2018\/10\/announcing-some-security-treats-to.html , October 2018 . Jonathan Skelker. Announcing some security treats to protect you from attackers' tricks. https:\/\/security.googleblog.com\/2018\/10\/announcing-some-security-treats-to.html, October 2018."},{"key":"e_1_3_2_1_27_1","volume-title":"Proceedings of the 2015 Workshop on the Economics of Information Security (WEIS)","author":"Thomas Kurt","year":"2015","unstructured":"Kurt Thomas , Danny Yuxing Huang , David Wang , Elie Bursztein , Chris Grier , Tom Holt , Christopher Kruegel , Damon McCoy , Stefan Savage , and Giovanni Vigna . Framing Dependencies Introduced by Underground Commoditization . In Proceedings of the 2015 Workshop on the Economics of Information Security (WEIS) , Delft, The Netherlands , June 2015 . Kurt Thomas, Danny Yuxing Huang, David Wang, Elie Bursztein, Chris Grier, Tom Holt, Christopher Kruegel, Damon McCoy, Stefan Savage, and Giovanni Vigna. Framing Dependencies Introduced by Underground Commoditization. In Proceedings of the 2015 Workshop on the Economics of Information Security (WEIS), Delft, The Netherlands, June 2015."},{"key":"e_1_3_2_1_28_1","first-page":"465","volume-title":"Damon McCoy. Dialing Back Abuse on Phone Verified Accounts. In Proceedings of the 2014 ACM Conference on Computer and Communications Security (CCS)","author":"Thomas Kurt","year":"2014","unstructured":"Kurt Thomas , Dmytro Iatskiv , Elie Bursztein , Tadek Pietraszek , Chris Grier , and Damon McCoy. Dialing Back Abuse on Phone Verified Accounts. In Proceedings of the 2014 ACM Conference on Computer and Communications Security (CCS) , pages 465 - 476 , Scottsdale, AZ, USA , November 2014 . Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier, and Damon McCoy. Dialing Back Abuse on Phone Verified Accounts. In Proceedings of the 2014 ACM Conference on Computer and Communications Security (CCS), pages 465-476, Scottsdale, AZ, USA, November 2014."},{"key":"e_1_3_2_1_29_1","volume-title":"Proceedings of the 2017 ACM Conference on Computer and Communications Security (CCS)","author":"Thomas Kurt","year":"2017","unstructured":"Kurt Thomas , Frank Li , Ali Zand , Jacob Barrett , Juri Ranieri , Luca Invernizzi , Yarik Markov , Oxana Comanescu , Vijay Eranti , Angelika Moscicki , Daniel Margolis , Vern Paxson , and Elie Bursztein . Data Breaches , Phishing, or Malware? : Understanding the Risks of Stolen Credentials . In Proceedings of the 2017 ACM Conference on Computer and Communications Security (CCS) , Dallas, TX, USA , October 2017 . Kurt Thomas, Frank Li, Ali Zand, Jacob Barrett, Juri Ranieri, Luca Invernizzi, Yarik Markov, Oxana Comanescu, Vijay Eranti, Angelika Moscicki, Daniel Margolis, Vern Paxson, and Elie Bursztein. Data Breaches, Phishing, or Malware?: Understanding the Risks of Stolen Credentials. In Proceedings of the 2017 ACM Conference on Computer and Communications Security (CCS), Dallas, TX, USA, October 2017."},{"key":"e_1_3_2_1_30_1","volume-title":"Vern Paxson. Trafficking Fraudulent Accounts: The Role of the Underground Market in Twitter Spam and Abuse. In Proceedings of the 22nd USENIX Security Symposium","author":"Thomas Kurt","year":"2013","unstructured":"Kurt Thomas , Damon McCoy , Chris Grier , Alek Kolcz , and Vern Paxson. Trafficking Fraudulent Accounts: The Role of the Underground Market in Twitter Spam and Abuse. In Proceedings of the 22nd USENIX Security Symposium , Washington, DC, USA , August 2013 . Kurt Thomas, Damon McCoy, Chris Grier, Alek Kolcz, and Vern Paxson. Trafficking Fraudulent Accounts: The Role of the Underground Market in Twitter Spam and Abuse. In Proceedings of the 22nd USENIX Security Symposium, Washington, DC, USA, August 2013."},{"key":"e_1_3_2_1_31_1","unstructured":"Verizon. 2018 Data Beach Investigations Report. https:\/\/www.verizonenterprise.com\/resources\/reports\/rp_DBIR_2018_Report_en_xg.pdf. Accessed: 2018-10-22.  Verizon. 2018 Data Beach Investigations Report. https:\/\/www.verizonenterprise.com\/resources\/reports\/rp_DBIR_2018_Report_en_xg.pdf. Accessed: 2018-10-22."},{"key":"e_1_3_2_1_32_1","unstructured":"Virus Total. https:\/\/www.virustotal.com\/#\/home\/upload. Accessed: 2018-10-22.  Virus Total. https:\/\/www.virustotal.com\/#\/home\/upload. Accessed: 2018-10-22."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/1242572.1242659"}],"event":{"name":"WWW '19: The Web Conference","location":"San Francisco CA USA","acronym":"WWW '19","sponsor":["IW3C2 International World Wide Web Conference Committee"]},"container-title":["The World Wide Web Conference"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3308558.3313489","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3308558.3313489","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T01:02:18Z","timestamp":1750208538000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3308558.3313489"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,5,13]]},"references-count":33,"alternative-id":["10.1145\/3308558.3313489","10.1145\/3308558"],"URL":"https:\/\/doi.org\/10.1145\/3308558.3313489","relation":{},"subject":[],"published":{"date-parts":[[2019,5,13]]},"assertion":[{"value":"2019-05-13","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}