November's Symposium on Electronic Crime Research (eCrime 2026) in Lisbon will interrogate the most consequential threats emerging on the cybercrime frontier – from software development supply chain attacks and cybercrime scam camps to the menacing rise of cybercriminal states – and will posit interventions to reverse the chaos on the world's internetworks.

Join APWG's membership – our tenured counter-cybercrime veterans from industry, law enforcement, government and NGO communities – as well as the avant-garde from eCrime's global cybercrime researcher fellowship –  as the eCrime symposium's storied delegation imagines cybercrime's demise. 

eCrime 2026's conference presentations, research dialog, training sessions and annual cybercrime policy roundtables comprise a uniquely comprehensive week of leading-edge innovations in cybercrime management, counter-cybercrime research and policy discussions starting on Nov. 2, the afternoon before the start of eCrime's proceedings:

• Nov. 2 - eCrime Training Sessions
• Nov. 3-5 - eCrime Conference Proceedings
• Evening of 5th - eCrime Chalk Talk / WIPs, Demos, Collaboration Opportunities & Wild Ideas Worthy of Domestication
• Nov. 6 - Roundtables on Measurement, Transparency, and Cyber Integrity Policy

• Please direct insights and questions to: ecrime2026@apwg.org

   

• Program presentations listed below:

NOTE: Peer-reviewed papers and general sessions will be presented November 3-5. The full conference week will include training sessions on Monday afternoon/evening (Nov. 2) and a policy session - by invitation - on Friday (Nov. 6) morning.

The IEEE Computer Society’s Technical Community on Security & Privacy Is Standing as Technical Sponsor of the APWG’s 2026 Symposium on Electronic Crime Research (eCrime 2026)

APWG eCrime 2026 Lisboa is a uniquely constructed symposium designed to to examine responses to cybercrime as well as to showcase the very latest research into counter-cybercrime techniques and technologies. As the only peer-reviewed, publishing research conference focused exclusively on cybercrime, APWG eCrime is also the most important venue for discovering those path-finding, thought-leading managers and investigators whom your organization has yet to hire - and needs to meet.

eCrime 2026 Delegates’ Accommodations: InterContinental Lisbon

APWG eCrime 2026 Accommodations / Discount Link

READ CAREFULLY BEFORE RESERVING: There is no deadline for reservations this year at conference venue, InterContinental Lisbon. All changes to reservations (e.g. arrival date, departure date, etc.) can incur charges or penalties. Any questions, please contact eCrime programs manager Joyce Perhac at joyce@apwg.org

eCrime 2026 Discounted Accommodation Links for All Delegates

Programmed Sessions:

Monday, November 2 Training Day Sessions for Cybercrime Interveners

Modeling Adversaries Through Chaos 

Pete Herzog, ISECOM, Co-founder

12:00-3:00 PM / Room Assignment: TBA 

Register Now

Threat Modeling Workshop and Training

Laurin Weissinger, UC Berkeley

3:00-5:00 PM /.Room Assignment: TBA

Register Now

Amplify the Signal: Investigating phishing campaigns through domain clustering 

Sven Krohlas, Spamhaus-abuse.ch

12:00-3:00 PM / Room Assignment: TBA 

Register Now

Practical API Integration: Connecting Applications to the eCrimex eXchange Data Clearinghouse

Carlos Ramirez, APWG Engineering

3:00-5:30 PM / Room Assignment: TBA 

Register Now

Click Here for Abstracts of Training Sessions for eCrime 2026

TUESDAY, November 3 eCrime's 21st Year Defining the Cybercrime Frontier

AI as cybercrime catalyst: from developer compromise to autonomous fraud ops

the business AND FINANCE of cybercrime

Cybercrime policy / multilateral and industrial

emerging technologies of cybercrime defense

wednesday, November 4 Day 2: Delineating & Defeating Cybercrime in 2026

Cybercrime measurement, characterization and attribution

cybercrimes of social violence

cybercrime and public sector law enforcement

APWG eCrime exchange update & Preview

Thursday, November 5 Day 3: Human Factors & Domestic Contexts

the rise of the Cybercriminal state

Behavioral aspects of cybercrime

THURSDAY NIGHT CHALK TALKWIPs, Demos, Collaboration Opportunities & Wild Ideas Worthy of Domestication

Join APWG eCrime delegates and industrial correspondents for a chalk talk to discuss works in progress, collaborations opportunities, R&D ideas – and to witness first hand demos of working technologies that may soon be managing the chaos of the cybercrime frontier.

The APWG’s Symposium on Electronic Crime (eCrime) invites: cybercrime research demonstrations; works in progress and  research proposals that exhibit important results and suggest applications; and telling comparative analyses from across the cybercrime and anti-abuse landscape.

Phishing Evolution: AI, Human Detection and Prevention

Presenter: Liliana Ribeiro, Universidade de Porto

Authors: Liliana Ribeiro, Carla Sofia Cardoso & Inês Sousa Guedes

CHALK TALK ABSTRACT: This work-in-progress explores how professionals with expertise in phishing detection, prevention and response perceive this evolution and its implications for detection and prevention. Participants inspect 12 emails (six phishing and six legitimate emails) while their visual attention is recorded using an eye-tracker. A semi-structured interview then explores their perceptions of phishing, its evolving techniques, detection challenges, reporting, prevention, and the role of institutions.

Beyond Explicit Content: Behavioural Mapping of Consumption Networks Around Sexualised Non-Explicit Material Involving Minors

Presenter: Serena Giugno, NOF Consulting

CHALK TALK ABSTRACT: Sexualised material involving minors can now be generated from ordinary footage parents publish themselves, leaving content-based detection permanently behind the rate at which new material is produced. This work in progress moves the unit of analysis from the material to the account: routine activity theory selects nodes meeting structural exposure conditions, and social network analysis then tests whether the resulting clusters are coordinated or artefactual. It never classifies content, and an analyst reviews every result before it goes further. Most of the session is about the failure mode. Five criteria tell a coordinated cluster from an ordinary one, and they don't carry equal weight. One decides: does this cluster take up almost everything an account cares about, or does it sit alongside other things? Fail that and nothing follows, whatever the other four say. Teachers, paediatricians and the accounts minors run for themselves generally sit alongside other things. One profile does not, and that profile belongs to a child. Telling it apart would mean knowing the account holder's age, which is the check nobody performs, and whose absence is what put the child in reach.

General Session Proposals: ecrime2026@apwg.org

FRIDAY NOVEMBER 6: POLICY ROUNDTABLERoundtable on Measurement, Transparency, and Cyber Integrity Policy

Presented By

AI Sovereignty Versus Internet Governance

The 2026 eCrime Measurement, Risk and Policy Roundtables will examine how Internet governance is evolving. Specifically, this year’s colloquium will consider how hyperscaled vertically integrated computational infrastructure providers and AI reasoning platforms have evolved into sovereignties in their own right. Within this dialog, delegates will examine how these new and still evolving Internet infrastructure titans are incrementally displacing contemporary Internet-governance frameworks as currently curated by groups like ICANN and ISOC and IGF/UN coordination.

Just a quarter century ago, the Internet's institutional architecture was programmatically distributed among constituencies representing different technical operations, technical standards, commercial interests and governance perspectives, embodied by organizations such as: ICANN; Registries and Registrars; IETF; RIRs; ISPs; and telcos. This multi-stakeholder model was itself, in part, a rejection of the national sovereignty/licensing model framed by the ITU and its suzerainty over telecommunications operating frameworks like SS7.

In 2026, today’s Internet governance model is being challenged by the operational
hegemony of integrated digital infrastructure platforms (e.g. AWS, Microsoft, Alphabet/Google, Oracle); Internet intermediation services providers (Cloudflare, Akamai); and AI reasoning platforms (e.g. OpenAI, Anthropic, etc.) as these hyperscaled Internet infrastructure powers exercise their own separate sovereignty over compute infrastructure, network mediation, AI reasoning, and enterprise operations, becoming constitutional actors in their own right.

The 2026 eCrime policy roundtable session will ask: Does this shift in the powers commanding authority over so many data logistics and archival functions, including content, communications, compute, identity, personal information, code, (end-user) devices, and so on require a civilization-level response? Do these transformations of anti-cybercrime enforcement power, evidentiary authority, and operational data-access necessitate prescriptive domain-specific (e.g. DNS; SS7; AI guardrails) ameliorative policy engagements? And, if so, what would those entail—and which political and diplomatic venues would develop and curate those updated policies?

The eCrime symposium has been holding our policy roundtable every year at the conclusion of eCrime since 2024. Our first year was hosted at the Fletcher School of Government and Diplomacy at Tufts University. Last year, CAIDA at San Diego Supercomputer Center was our host. These eCrime Measurement, Risk and Policy Roundtables are APWG eCrime’s attempt to measure the gap between cybercrime’s advances and the policy infrastructure (public and private sectors both) that is required to manage contemporary cyber threats like other kinds of persistent, civilization wide risks such as those related to public health, underwriting risks, etc.

This link provides full draft prospectus in PDF format, for viewing and printing:

Download Roundtables Prospectus

APWG eCrime 2026 at a Glance

eCrime 2026's conference presentations, research dialog, training sessions and annual cybercrime policy roundtable will present a full week of leading-edge industrial innovation in cybercrime management, counter-cybercrime research and policy discussions starting on the afternoon before the start of eCrime's proceedings:

• Nov 2 - Training Sessions
• Nov 3-5 - eCrime Conference Proceedings
• Evening of 5th - eCrime Chalk Talk / WIPs, Demos, Collaboration Opportunities & Wild Ideas Worthy of Domestication
• Nov 6 - Roundtable on Measurement, Transparency, and Cyber Integrity Policy

APWG member registration links and non-member enrollment for eCrime 2026 will be announced on this page in the weeks to come. 

Proposals for General Session presentations (Subject: General Session Proposal)  at eCrime 2026 can be forwarded to ecrime2026@apwg.org

Deadline: September 3 - sooner is better

Researchers seeking to submit papers for peer review can find full instructions below under "Guidance for Authors". Peer-reviewed papers are submitted through the conference’s HotCRP webpage at: https://ecrime2026.hotcrp.com/

Deadline: June 12, 2026, 12 AM EDT

APWG eCrime is also the most important venue for discovering those path-finding, thought-leading managers and investigators whom your organization have yet to hire - and need to meet.

APWG eCrime 2026 Sponsorship Memorandum / Members & Non-Members

Members, delegates and other interested parties seeking sponsorship opportunities at APWG eCrime 2026 may inspect the sponsorship memorandum linked above and/or contact symposium managers at ecrime2026@apwg.org. 

Your eCrime 2026 Hosts / Symposium's Chairs

(L to R) General Chair Laurin Weissinger (UC Berkeley / Tufts University), Program Chair Ebrima Ceesay (NeuroSec.AI) and Publications Chair Miranda Bruce (Independent Investigator)

Call for Papers

Beyond soliciting research into cybercrime that inflicts financial losses, as the symposium has since 2006, eCrime 2026’s chairs are particularly interested in papers that address challenges in: cyber-physical systems and operational technologies; artificial intelligence; and the interaction between different system layers (such as socio-technical systems) that are employed or abused by cybercriminals for profit – and for advancement of larger criminal enterprises.

Solicited Topics Consonant With eCrime 2026’s Theme Include:

Artificial Intelligence (AI) as criminal co-conspirator and defensive collaborator, such as:
 

• Malicious AI agents employed to perform enhanced malware polymorphism, agentic spearphishing, reconnaissance, etc.
  Development and maintenance of criminal co-pilots and the future of human-machine teaming, including hybridized human-crimebot cyber gangs.
• Are malicious AI tools lowering the skills barrier to commit more advanced cybercrimes?
• Adversarial AI (attacks directly against AIs and machine learning systems) as it relates to the furtherance of cybercrime or cyber-physical cybercrime — especially agents employed in security operations
• Defensive AI Agents deployed as cybersecurity operations managers and (autonomous and semi-autonomous) counter-cybercrime managers
• Design, deployment and assessment of multi-agent environments (MAEs) for enhancing resilience of infrastructure and systems to cybercrime
• Design, deployment and assessment of defences related to AI systems themselves (jailbreaks, injections, etc.)
• Actual, emerging or potential risks from AI systems deployed to animate cybercrimes against people, operational systems, IoT technologies, or physical spaces and objects
• Abuse of cyber-physical systems and operational technologies and downstream manipulation (extant, emerging or potential) for furtherance of crimes with physical manifestations, including:
  • Drone and robot hijacking and weaponization;
  • Criminal abuses and weaponization of medical and surgical systems;
  • Criminal abuses and weaponization of IoT for domestic and commercial targeting;
  • Criminal abuses and weaponization of autonomous vehicles and delivery robots
  • AI and machine-learning system security to mitigate threats posed by advanced cybercriminal algorithms — and to guard against strategically misinforming and abusing them for criminal enterprises
  • New research on policy, regulation, and law as they pertain to cybercrime of all types

AI and machine-learning system security to mitigate threats posed by advanced cybercriminal algorithms — and to guard against strategically misinforming and abusing them for criminal enterprises
New research on policy, regulation, and law as they pertain to cybercrime of all types

Topics of general interest for submissions to eCrime 2026 are listed below, under the heading “Solicited Research Topics for APWG eCrime 2026.”

Important Dates (papers):

Full Paper Registration / Submission of full draft due: 12 June

Training Session Proposals / full draft due:  15 June 2026

Notification of Acceptance / Shepherding decisions: 7 August 2026

Shepherding:  7 August to 31 August

Conference: November: 2 – 6, 2026

Camera-ready paper due: November 30th, 2026
 

The selected peer-reviewed papers will be presented at the eCrime symposium along with panels and talks in General Sessions from other researchers selected from industrial and academic research centers correspondent with the APWG.

General Information
eCrime sessions and proceedings are in English.
The Lisbon venue is the Intercontinental Lisbon. Room reservation link to come in a later edition of this CFP: 

Please contact the APWG eCrime organizers for any other details via email at apwg_events@apwg.org.

Discounts
Students requiring discounts should contact symposium managers at apwg_events@apwg.org
IEEE members and partners requiring discounts should contact symposium managers at apwg_events@apwg.org
Discount codes are also available for university researchers, government personnel and law enforcement professionals from pubic-sector agencies as well as for IEEE members.
Please contact the APWG eCrime organizers for details via email at: apwg_events@apwg.org.

Solicited Research Topics for APWG eCrime 2026
Since 2006, APWG eCrime has cast its call for papers in relevant research disciplines, focusing in large part on financial crimes that abuse Internet technologies and IT to victimize users, enterprises and their brands.

APWG eCrime also specifically solicits original research on cyber-physical systems and operational technologies abused in the furtherance of any kind of crime: cyber (digital) or manifested in physical spaces, such as homes, enterprises, roadways, public spaces and critical infrastructure.

eCrime’s curators define these cybercrimes as those that exploit, disrupt, or manipulate cyber-physical systems or operational technologies — systems that integrate control, feedback, and communication mechanisms across digital, mechanical, and biological domains.

The selected peer-reviewed papers will be presented at the eCrime symposium along with panels and talks in General Sessions from other researchers selected from industrial and academic research centers correspondent with the APWG.

Alongside this expanded topic spectrum, eCrime 2026 Lisbon is also soliciting papers that speak to the following topics and issues:
Economic foundations of: cybercrime cyber-physical crimes; and other abuses of IT for criminal enterprise

• Behavioural and psychosocial aspects of cybercrime; and cyber-physical system victimization and prevention

   

• Emerging technological exposures, vulnerabilities, and risks

   

• Architectural vulnerabilities (of products, operational technologies, infrastructures and cyber-physical systems) that advantage criminal actors

   

• New or improved techniques to detect and respond to cybercrime and cyber-physical crimes of all types 

   

• How to accurately measure and understand the health and resilience of systems, networks, infrastructures and users against cybercrime

   

• Addressing challenges of cybercrime’s increasing complexity (e.g. digital infrastructures, crime-fighting/forensic techniques, and the structure of the crimes themselves)

   

• Measuring and modelling of cybercrime/cyber-physical system crimes and related criminal enterprises for operational protection routines

   

• Measuring and modelling of cybercrime/cyber-physical system crimes and related criminal enterprises for informing rational underwriting instrumentation developed by commercial insurers
   
• Analysis and modelling of the cybercrime and abuse risk landscape
  Cybercrime/cyber-physical system crime payload delivery strategies and countermeasures (e.g. spam, mobile apps, social engineering, etc.)
   
• Application of public policy and law for the programmatic suppression of common cybercrimes; crimes against or involving cyber-physical systems and related abuses
   
• Policy and legal challenges as they relate to actually developing and sustaining anti-cybercrime practices and policies
   
• Cryptocurrency crimes and related cybercrimes, and the forensic tools and techniques required to measure, prevent, and counter these crimes
   
• Case studies of current cybercrime/cyber-physical system attack methods (e.g. phishing, malware, rogue antivirus programs, pharming, ransomware, crimeware, botnets, and emerging techniques)
   
• Detecting and preventing abuse of internet infrastructure to neutralize cybercrimes/cyber-physical system crimes and abuses
   
• Detecting and isolating cybercriminal gangs and their money laundering routines and enterprises
   
• Cybercrime’s evolution in specific verticals (e.g. financial services, e-commerce, health and energy, etc.)
   
• Cybercriminal cloaking techniques, and counter-cloaking tools and approaches
   
• Design and evaluation of UI/UXs to neutralize fraud and enhance user security and cybercrime awareness
   
• Novel methods for measuring cybercrime and related abuses for development of defensive routines and programs

Guidance for Authors
Submit papers here: https://ecrime2026.hotcrp.com
eCrime has adopted the IEEE publication format. Submissions should be in English, in PDF format with all fonts embedded, and formatted using the IEEE conference template, which can be found at:
https://www.ieee.org/conferences_events/conferences/publishing/templates.html

Submissions must include author names and affiliations, but should otherwise be anonymized. Authors’ own work should be referred to in the third person.
 

Papers should not exceed 12 letter-sized pages, excluding the bibliography and appendices. Committee members are not required to read appendices, so ensure that the main paper is intelligible without them.
 

Submitted papers that do not adhere to all the above guidelines may be rejected without consideration of their merits.
 

Authors of accepted papers must register for the event and present in person. Remote presentations delivered live and/or pre-recorded presentations will be considered in limited circumstances (e.g. where the lead author presents remotely and a co-author attends in person).
 

Authors will be asked to indicate whether they would like their submissions to be considered for the Best Student Paper Award. Any paper co-authored by a full-time student is eligible for this award.
 

Authors of accepted papers must guarantee that their paper will be presented at the conference. APWG eCrime understands that some authors may face difficulties in obtaining funding to attend the conference. 

Therefore, a limited number of stipends are available for those who are unable to secure departmental or institutional underwriting for their travel. Students who will present their accepted papers themselves will be given priority in receiving this assistance.

Please contact the APWG eCrime organizers for details via email at: apwg_events@apwg.org.

Call for Training Day Proposals

Are you an expert in a cybercrime research, cyber forensics or related investigation methods? Do you use a specialised resource/repository and want to show others how to use it too (or use it better)? Have you authored a new framework or modelling technique that you think more people should know about?

At eCrime 2026 Lisbon, APWG will feature a pre-conference eCrime Training Day for researchers and industry practitioners. Trainers will have the opportunity to discuss their areas of expertise with attendees on Monday, November 2, the day before the conference begins (on 3 November). These longer sessions, more directly personal instructional programs are aimed at transferring skills and passing the torch to a new generation of researchers and practitioners.

Sessions could focus on a variety of relevant topics, such as:

• How to collect, use, and analyse cybercrime data in investigations and/or research projects

• How to investigate key data repositories, such as the DNS ecosystem, for research and investigations

• New modelling methods for cyber threats, risks, and vulnerabilities

• How to engage with policymakers as a cyber researcher or industry expert

• An intro session for cybercrime researchers/investigators focusing on relevant security frameworks, standards, and best practices

   

Training session proposals should include:

• Training session titleTrainer/artisan biographic description 3-6 sentences of direct relevance to topic space covered in the proposed session

• Topic description of 3-6 sentences describing what the training session will cover and competencies it will cultivate

• Audience: eCrime prefers sessions that any eCrime attendee could benefit from; however, please note if your session would especially benefit a specific audience (e.g. threat intelligence researcher)

• Prerequisites: eCrime prefers training sessions that do not require any prerequisites; however, we may make an exception for a topic of particular merit or interest

• Session length minimum of 1 hour, maximum of 3 hours. Please also indicate whether your session length is strict (i.e. if we receive many session proposals, or if a trainer drops out, would you be able to make your session longer or shorter)

Include all the information above in a Word or PDF document and upload to https://ecrime2026.hotcrp.com and title your submission with “TRAINING DAY PROPOSAL” followed by your session title (for example “TRAINING DAY PROPOSAL Using the OWASP model in SMEs”.)

A maximum of 4 training sessions will be offered.

Important Dates (eCrime Training Day proposals) 

Deadline for Proposals: June 15th 2026

Notification of Acceptance: July 15th 2026

Anticipated time for each training session: 1 to 3 hours, with a preference for longer, in-depth sessions that afford ample time for peer-to-peer and instructor-to-trainees dialog. If there is sufficient interest, APWG eCrime 2026 will consider running parallel sessions.