TBTrackerX: Fantastic Trigger Bots and Where to Find Malicious Campaigns on X

TBTrackerX: Fantastic Trigger Bots and Where to Find Malicious Campaigns on X

Speakers: Mohammad Majid Akhtar

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=1hRgC-hVi4I

Overview

This research presents a systematic measurement and detection study of trigger bots on Twitter/X -- automated accounts that activate only when specific keywords appear in user posts or tweets. Unlike traditional social media bots that operate continuously, trigger bots lie dormant until triggered by keywords such as "MetaMask," "Robux," or other cryptocurrency and service-related terms, then flood the original post with deceptive replies designed to scam users.

Using a honeypot methodology that posted keyword-embedded tweets every 12 hours for 30 days, the researchers collected 4,500+ trigger bot replies from 2,647 unique bot agents across 10 keywords grouped into four campaign categories. Multi-dimensional analysis revealed sophisticated evasion techniques including contextually similar but syntactically different replies (likely LLM-generated), dormancy periods between peak campaigns, and bulk account creation using temporary email servers. An XGBoost classifier using just 10 features achieved the best detection performance, outperforming both transformer models and existing tools like BotHunter.

Background

▶ Watch: Introduction to trigger bots: keyword-activated automated accounts (0:00)

On social media platforms, automated bot accounts are used to inflate social presence, manipulate discourse, and conduct scams. Prior research has analyzed bots that buy followers, likes, and retweets. This work focuses on a specific subset: trigger-based bots that are activated by particular keywords present intentionally or unintentionally in user tweets.

The problem was first observed around 2021 and was systematized in the authors' prior work published at AsiaCCS 2024, which focused on reply-based phishing attacks. Previous research has shown these bots cause real financial damage -- one study documented approximately 38 Bitcoin and 19 Ethereum stolen from victims through trigger bot scams.

A typical trigger bot attack flow works as follows: a user tweets mentioning a keyword like "MetaMask" (a cryptocurrency wallet). Trigger bots immediately reply with responses that appear to offer support but contain red flags -- non-official support email addresses, contextually similar but paraphrased messages across multiple bot accounts. While tech-savvy users might recognize these red flags, the replies are effective against less experienced users, particularly those seeking help with cryptocurrency issues.

The challenge for platforms is that these bots employ multiple evasion techniques, making them difficult to distinguish from legitimate accounts using automated detection.

Key Findings

▶ Watch: Honeypot methodology: 30 keywords, 4 campaign categories (4:00)

19 of 30 candidate keywords are actively targeted by trigger bots. Through comprehensive survey of social media platforms, seed accounts, research articles, and forums, the researchers identified 30 trigger-bot-prone keywords, of which 19 showed active bot responses. These were grouped into 10 representative keywords across four campaign categories.

Four distinct campaign types identified: (1) Deceptive support campaigns -- bots impersonate official support for cryptocurrency wallets and platforms, using email for follow-up communication. (2) Illicit product campaigns -- bots act as affiliates/sellers for pirated material and psychedelic drugs, using @mentions for communication. (3) Misleading giveaway campaigns -- bots attempt to extort money, preferring direct messages for private communication. (4) Benign campaigns -- freelancers (logo design, graphic design, essay writing) using URLs to share portfolios.

57-68% of malicious bot accounts were suspended within 3-4 months. Monitoring from August to December 2024 showed that the platform (X) suspended the majority of malicious trigger bot accounts, though a significant 33-43% remained active.

Replies are contextually similar but syntactically different. Cosine similarity analysis using RoBERTa embeddings showed high contextual similarity across bot replies within campaigns, while TF-IDF analysis showed syntactic diversity -- suggesting the use of LLMs or text spinners to generate paraphrased variations that evade content-based filtering.

Dormancy after peak campaigns is a key evasion technique. Bots show burst activity during peak campaign periods, then enter dormant states to avoid detection, resuming activity later.

XGBoost with 10 features outperforms all other models. Classical ML (XGBoost) beat transformer models, LLMs, and existing tools (BotMeter, BotHunter) for both campaign attribution and malicious/benign classification, using primarily profile-based features.

Technical Deep Dive

▶ Watch: Communication modes: email, mentions, DMs by campaign type (10:00)

The methodology consists of four modules:

Tweet Generator Module: A honeypot system that posts tweets containing trigger-bot-prone keywords every 12 hours across dedicated accounts. The tweets use a baseline pretext with embedded keywords designed to lure trigger bots. The experiment ran for 30 days in March 2024, producing approximately 600 keyword-embedded tweets.

Profile Collection Module: When trigger bots interact with honeypot tweets, their complete profile data and reply content are collected for analysis.

Measurement and Characterization Module: Multi-dimensional analysis covers:

• Profile analysis -- account creation dates, bulk registration patterns using temporary email servers
• Content analysis -- RoBERTa embeddings for semantic similarity, TF-IDF for syntactic diversity, communication mode preferences per campaign
• Temporal analysis -- activity patterns, peak/dormancy cycles
• Longitudinal analysis -- tracking account lifecycles from March 2024 to January 2025
• TB ecosystem analysis -- inter-bot network relationships

Detection Module: Two detection tasks were defined: (1) Campaign attribution -- classifying which of the four campaigns a bot belongs to, and (2) Malicious/benign classification -- distinguishing malicious bots from benign freelancer bots. Models tested include classical ML (XGBoost, Random Forest), transformer-based models, and LLMs. Only 10 features were used, predominantly profile features with one content feature (the reply text).

Ground truth establishment: Initially collected bot accounts were monitored for 3-4 months; accounts suspended by the platform served as confirmed ground truth. Remaining accounts were labeled by three human annotators using defined criteria, confirming the methodology exclusively captured trigger bot agents.

Demo / Proof of Concept

▶ Watch: Evasion techniques: LLM-paraphrased replies and dormancy cycles (12:00)

The honeypot system successfully attracted 4,500+ trigger bot replies from 2,647 unique agents across 10 keywords in a single month of operation. The detection system using XGBoost achieved strong performance in both campaign attribution (identifying which campaign a bot belongs to) and malicious/benign classification.

Cross-campaign generalization experiments (training on some campaigns, testing on others) were conducted and detailed in the paper, showing reasonable transferability of the detection model.

Defensive Implications

▶ Watch: Recommendations and multilingual trigger bot research directions (18:00)

The researchers provide specific recommendations for three stakeholders:

For platforms (X/Twitter): Suggest alternatives for users to sanitize tweets before posting (removing or obfuscating trigger-prone keywords). Tighten policies on temporary email servers used for bulk account creation -- the researchers observed most trigger bot accounts were freshly created in bulk using temporary email services. Implement detection mechanisms informed by the 10 discriminative features identified in this research.

For social media users: Avoid follow-for-follow and like-for-like schemes that trigger bots exploit to embed themselves in user networks. Be cautious with trigger-bot-prone keywords (MetaMask, Robux, DMT, etc.). Recognize red flags in replies: non-official support emails, contextually similar responses from multiple accounts, requests to move communication to DMs or email.

For researchers: Reverse engineer trigger bot reply generators to understand the text generation pipeline. Investigate multilingual trigger bots -- the research focused on English keywords but noted that bots are multilingual and may be triggered by keywords in Japanese, Chinese, and other languages. Develop campaign-agnostic detection that relies solely on profile features rather than requiring reply content.

The finding that 57-68% of malicious accounts are suspended within 3-4 months but a significant portion remains active highlights the ongoing detection gap on the platform.

Key Takeaways

• Trigger bots are automated accounts that activate only when specific keywords appear in tweets, targeting cryptocurrency, support, illicit products, and giveaway themes
• A 30-day honeypot study captured 4,500+ trigger bot replies from 2,647 unique agents across 10 keywords
• Bots use LLM-generated paraphrased replies that are contextually similar but syntactically different to evade content-based filtering
• Dormancy periods between peak campaigns and bulk account creation via temporary email servers are key evasion techniques
• XGBoost with just 10 features (primarily profile-based) outperforms transformer models and existing bot detection tools
• 57-68% of malicious trigger bot accounts are suspended by X within 3-4 months, but 33-43% remain active
• Previous research documented 38 BTC and 19 ETH stolen through trigger bot scams

About the Speaker(s)

The talk was presented by Muhammad Iikram, a senior lecturer at Macquarie University. The research was conducted in collaboration with PhD student Mohammad Majid Akhtar, Dr. Rahit Masud, and Professor Salil Kanhere from the University of New South Wales. The team specializes in social media security, bot detection, and online fraud measurement.