ScamBuster Uses AI to Turn Phishing Scammers' Tactics Against Them
An open-source tool named ScamBuster employs AI to impersonate potential victims, engaging with phishing attackers to gather intelligence on their operations and infrastructure.
In the ongoing battle against email-based scams, a novel approach is emerging that aims to turn the tables on cybercriminals. Laurent Giovannoni, a principal software engineer at Filigran, has developed 'ScamBuster,' an open-source system designed to use artificial intelligence (AI) to impersonate potential victims and engage with phishing attackers. This innovative tool seeks to collect valuable intelligence on attacker tactics, techniques, and procedures (TTPs), as well as their operational infrastructure, thereby providing crucial data for security researchers and law enforcement.
The inspiration for ScamBuster stemmed from personal encounters with phishing attacks affecting friends. Giovannoni developed the system as part of his thesis at École Polytechnique in France. While many malicious emails are simply deleted by users or security software, this approach does little to hold attackers accountable or prevent future attacks. ScamBuster offers an alternative by actively engaging with these threats, rather than passively discarding them.
ScamBuster operates strictly as an inbound-only system, meaning it never initiates contact. Its core function is to respond to incoming scam emails by adopting an AI-driven human persona that the scammer believes is falling for the bait. These personas can range from an elderly widow to a busy executive or a novice tourist, carefully crafted to elicit specific responses from the attacker. The ultimate goal is to extract actionable intelligence.
When ScamBuster engages with a scammer, it masquerades as a vulnerable target, all while its underlying AI agents work to gather information. The system is designed to extract details about the attacker's infrastructure, such as bank account information, phone numbers, and payment routing methods. This data is then meticulously collected and structured, transforming raw interactions into valuable intelligence that can be used to identify perpetrators and link separate scams.
By clustering indicators like International Bank Account Numbers (IBANs) and payment domains, ScamBuster helps build comprehensive profiles of cybercriminal operations. What might appear as numerous isolated scam attempts can, through ScamBuster's analysis, be traced back to a common set of infrastructure, providing a critical starting point for investigations by organizations, security researchers, and law enforcement agencies.
To maintain the believability of its interactions and to effectively counter the psychological tactics employed by scammers, ScamBuster utilizes AI to learn and adapt. It identifies which conversational patterns are most effective in eliciting financial and tracking information. The system continuously refines its approach, learning which personas are most successful against different types of scams, thereby improving its intelligence-gathering capabilities over time.
Under the hood, ScamBuster employs a set of large language model (LLM) agents to manage conversations, score the information revealed by scammers, and save it as structured threat intelligence. It is designed to be cost-effective, utilizing smaller, commercially available models like GPT-4o-mini, with running costs kept minimal. Importantly, the system is AI-agnostic, allowing users to integrate their preferred LLMs, whether from providers like OpenAI or Anthropic, or open-source alternatives, offering flexibility and adaptability.