Doxing refers to the disclosure of personal information without consent, has evolved from sporadic acts of online vigilantism into a structured and commodified practice. In Chinese cyberspace, this shift has produced Doxing-as-a-Service (DaaS), a commercial model in which personal data is retrieved, organized, and traded as on-demand products. This industrialization of privacy violation lowers the barriers to doxing and amplifies its social harms, posing new challenges for building a responsible and safe web. Yet little is known about how DaaS operates or sustains itself, motivating our systematic, data-driven examination of its ecosystem and practices. This paper provides the first systematic study of the Chinese DaaS ecosystem. Analyzing 25,972 messages and 13.22 million subscriber links from 100 major channels on Telegram, we demystify its organization, operations, and user engagement. We find that the DaaS ecosystem operates through a three-tier supply chain linking data providers, service operators, and end users. Operators sustain illicit businesses through six major service categories, persistent advertising, and crypto-based payments, while users interact via specialized group spaces that enable real-time matching, large-scale identity exposure, and community-driven fraud mitigation. Our findings reveal a mature, resilient underground data market operating within mainstream messaging platforms, highlighting new challenges for online privacy and exposing critical vulnerabilities in platform governance and content moderation. This study provides empirical evidence for developing effective regulatory frameworks and accountability mechanisms to mitigate commodified online harms on encrypted messaging services.

Android app security is a critical concern for the software industry, with companies investing significantly in protecting their intellectual property from reverse engineering attacks. While commercial protection tools exist to prevent decompilation and unauthorized code access, they pose substantial challenges for businesses: high licensing costs ranging from thousands to tens of thousands of dollars annually, significant performance overhead that impacts user experience and app ratings, and increased app size that affects download rates. These limitations particularly burden small to medium-sized enterprises and independent developers, creating an urgent industry need for cost-effective protection solutions.To address these challenges, we propose a novel file format-based anti-decompilation strategy that systematically exploits structural vulnerabilities in APK files. Building upon this strategy, we have developed APKARMOR, a lightweight and cost-effective anti-decompilation framework that exploits inherent vulnerabilities in popular reverse engineering tools. Through systematic analysis, we first identified critical weaknesses in common decompilation tools’ parsing mechanisms and structural assumptions. Based on these findings, we developed seven mutation-based protection strategies that deliberately trigger these vulnerabilities by introducing specific structural anomalies into APK files and the AndroidManifest.xml. These methods include Countermeasures against Dirty Code and Corrupted Payloads (CACoP), Pseudo-Encryption (PE), Using Unknown Compression Method (UUCM), Unavailable Magic Value (UMA), Modify the Offset Field in stringChunk (MOFS), and Dirty Bytecode Replacement of "Android" (DRA). We evaluated our exploitation strategies through extensive experiments on 100 randomly selected Android apps, testing against the latest versions of three widely used decompilation tools: JADX (v1.5.1), APKTool (v2.11.0), and Androguard (v4.1.2). Our results demonstrate that PE and DRA achieved complete protection by successfully exploiting vulnerabilities present in all tested tools. MOFS, UUCM, and UNV effectively exploited weaknesses in APKTool and Androguard’s parsing mechanisms.

Unlike fungible tokens (e.g., cryptocurrency), a Non-Fungible Token (NFT) is unique and indivisible. As such, they can be used to authenticate ownership of digital assets (e.g., a photo) in a decentralized fashion. Given that NFTs have generated significant media attention since 2021, we perform a large-scale measurement study of the NFT ecosystem. We collect over 242M transfer logs and over 97M marketplace transactions until Aug 1st, 2023, by far the largest NFT dataset, to the best of our knowledge. We characterize the on-chain behavior of NFTs and their trading across five major marketplaces. We find that, although the NFT ecosystem is growing rapidly, it is driven by a relatively small set of dominant centralized players, with suspicious trade activities, e.g., over 23% of the monetary volume is generated by malicious wash trading and the ecosystem has experienced over 157K cases of NFT arbitrage, with a total sum of over \25M profit. Our observations motivate the need for more research efforts in the NFT security analysis.

DNS has often been criticized for inherent design flaws, which make the system vulnerable to attack. Further, domain names are not fully controlled by users, meaning that they can easily be taken down by authorities and registrars. Due to this, there have been efforts to build a decentralized name service that gives greater control to domain owners. The Ethereum Name Service (ENS) is a major example. Yet, no existing work has systematically studied this emerging system, particularly regarding security and misbehavior. To address this gap, we present the first large-scale measurement study of ENS. Our findings suggest that ENS has shown growth during its four years' evolution. We identify several security issues, including traditional name system problems, as well as new issues introduced by the unique properties of ENS. We find that attackers are abusing the system with thousands of squatting ENS names, a number of scam blockchain addresses and indexing of malicious websites. We further develop a new record persistence attack, to find that 22,716 .eth names (3.7% of all names) are vulnerable to name hijacking. Our exploration suggests that our community should invest more effort into the detection and mitigation of issues in decentralized name services.

Ever since the beginning of the outbreak of the COVID-19 pandemic, attackers acted quickly to exploit the confusion, uncertainty and anxiety caused by the pandemic and launched various attacks through COVID-19 themed malicious domains. Malicious domains are rarely deployed independently, but rather almost always belong to much bigger and coordinated attack campaigns. Thus, analyzing COVID-themed malicious domains from the angle of attack campaigns would help us gain a deeper understanding of the scale, scope and sophistication of the threats imposed by such malicious domains. In this paper, we collect data from multiple sources, and identify and characterize COVID-themed malicious domain campaigns, including the evolution of such campaigns, their underlying infrastructures and the different strategies taken by attackers behind these campaigns. Our exploration suggests that some malicious domains have strong correlations, which can guide us to identify new malicious domains and raise alarms at the early stage of their deployment. The results shed light on the emergency for detecting and mitigating public event related cyber attacks.