@spam: the underground on 140 characters or less. - Chris Grier; Kurt Thomas; Vern Paxson; Chao Michael Zhang (CCS, 2010)

The Koobface botnet and the rise of social malware. - Kurt Thomas; David M. Nicol (MALWARE, 2010)

unFriendly: Multi-party Privacy Risks in Social Networks. - Kurt Thomas; Chris Grier; David M. Nicol (Privacy Enhancing Technologies, 2010)

Suspended accounts in retrospect: an analysis of twitter spam. - Kurt Thomas; Chris Grier; Dawn Song; Vern Paxson (Internet Measurement Conference, 2011)

Design and Evaluation of a Real-Time URL Spam Filtering Service. - Kurt Thomas; Chris Grier; Justin Ma; Vern Paxson; Dawn Song (IEEE Symposium on Security and Privacy, 2011)

Manufacturing compromise: the emergence of exploit-as-a-service. - Chris Grier; Lucas Ballard; Juan Caballero; Neha Chachra; Christian J. Dietrich; Kirill Levchenko; Panayiotis Mavrommatis; Damon McCoy; Antonio Nappa; Andreas Pitsillidis; Niels Provos; M. Zubair Rafique; et al. (CCS, 2012)

Adapting Social Spam Infrastructure for Political Censorship. - Kurt Thomas; Chris Grier; Vern Paxson (LEET, 2012)

Practical Comprehensive Bounds on Surreptitious Communication over DNS. - Vern Paxson; Mihai Christodorescu; Mobin Javed; Josyula R. Rao; Reiner Sailer; Douglas Lee Schales; Marc Ph. Stoecklin; Kurt Thomas; Wietse Z. Venema; Nicholas Weaver (USENIX Security Symposium, 2013)

Trafficking Fraudulent Accounts: The Role of the Underground Market in Twitter Spam and Abuse. - Kurt Thomas; Damon McCoy; Chris Grier; Alek Kolcz; Vern Paxson (USENIX Security Symposium, 2013)

The Role of the Underground Economy in Social Network Spam and Abuse. - Kurt Thomas (2013)

Dialing Back Abuse on Phone Verified Accounts. - Kurt Thomas; Dmytro Iatskiv; Elie Bursztein; Tadek Pietraszek; Chris Grier; Damon McCoy (CCS, 2014)

Consequences of Connectivity: Characterizing Account Hijacking on Twitter. - Kurt Thomas; Frank Li 001; Chris Grier; Vern Paxson (CCS, 2014)

Neither Snow Nor Rain Nor MITM...: An Empirical Analysis of Email Delivery Security. - Zakir Durumeric; David Adrian; Ariana Mirian; James Kasten; Elie Bursztein; Nicolas Lidzborski; Kurt Thomas; Vijay Eranti; Michael D. Bailey; J. Alex Halderman (Internet Measurement Conference, 2015)

Ad Injection at Scale: Assessing Deceptive Advertisement Modifications. - Kurt Thomas; Elie Bursztein; Chris Grier; Grant Ho; Nav Jagpal; Alexandros Kapravelos; Damon McCoy; Antonio Nappa; Vern Paxson; Paul Pearce; Niels Provos; Moheeb Abu Rajab (IEEE Symposium on Security and Privacy, 2015)

Trends and Lessons from Three Years Fighting Malicious Extensions. - Nav Jagpal; Eric Dingle; Jean-Philippe Gravel; Panayiotis Mavrommatis; Niels Provos; Moheeb Abu Rajab; Kurt Thomas (USENIX Security Symposium, 2015)

Framing Dependencies Introduced by Underground Commoditization. - Kurt Thomas; Danny Yuxing Huang; David Y. Wang; Elie Bursztein; Chris Grier; Tom Holt; Christopher Kruegel; Damon McCoy; Stefan Savage; Giovanni Vigna (WEIS, 2015)

SybilFrame: A Defense-in-Depth Framework for Structure-Based Sybil Detection. - Peng Gao 008; Neil Zhenqiang Gong; Sanjeev R. Kulkarni; Kurt Thomas; Prateek Mittal (CoRR, 2015)

Picasso: Lightweight Device Class Fingerprinting for Web Clients. - Elie Bursztein; Artem Malyshev; Tadek Pietraszek; Kurt Thomas (SPSM@CCS, 2016)

The Abuse Sharing Economy: Understanding the Limits of Threat Exchanges. - Kurt Thomas; Rony Amira; Adi Ben-Yoash; Ori Folger; Amir Hardon; Ari Berger; Elie Bursztein; Michael D. Bailey (RAID, 2016)

Cloak of Visibility: Detecting When Machines Browse a Different Web. - Luca Invernizzi; Kurt Thomas; Alexandros Kapravelos; Oxana Comanescu; Jean-Michel Picod; Elie Bursztein (IEEE Symposium on Security and Privacy, 2016)

Investigating Commercial Pay-Per-Install and the Distribution of Unwanted Software. - Kurt Thomas; Juan A. Elices Crespo; Ryan Rasti; Jean-Michel Picod; Cait Phillips; Marc-André Decoste; Chris Sharp; Fabio Tirelo; Ali Tofigh; Marc-Antoine Courteau; Lucas Ballard; Robert Shield; et al. (USENIX Security Symposium, 2016)

Remedying Web Hijacking: Notification Effectiveness and Webmaster Comprehension. - Frank Li 001; Grant Ho; Eric Kuan; Yuan Niu; Lucas Ballard; Kurt Thomas; Elie Bursztein; Vern Paxson (WWW, 2016)

Data Breaches, Phishing, or Malware?: Understanding the Risks of Stolen Credentials. - Kurt Thomas; Frank Li 001; Ali Zand; Jacob Barrett; Juri Ranieri; Luca Invernizzi; Yarik Markov; Oxana Comanescu; Vijay Eranti; Angelika Moscicki; Daniel Margolis; Vern Paxson; et al. (CCS, 2017)

Understanding the Mirai Botnet. - Manos Antonakakis; Tim April; Michael D. Bailey; Matt Bernhard; Elie Bursztein; Jaime Cochran; Zakir Durumeric; J. Alex Halderman; Luca Invernizzi; Michalis Kallitsis 001; Deepak Kumar 006; Chaz Lever; et al. (USENIX Security Symposium, 2017)

Pinning Down Abuse on Google Maps. - Danny Yuxing Huang; Doug Grundman; Kurt Thomas; Abhishek Kumar; Elie Bursztein; Kirill Levchenko; Alex C. Snoeren (WWW, 2017)

SYBILFUSE: Combining Local Attributes with Global Structure to Perform Robust Sybil Detection. - Peng Gao 008; Binghui Wang; Neil Zhenqiang Gong; Sanjeev R. Kulkarni; Kurt Thomas; Prateek Mittal (CNS, 2018)

Data Breaches: User Comprehension, Expectations, and Concerns with Handling Exposed Data. - Sowmya Karunakaran; Kurt Thomas; Elie Bursztein; Oxana Comanescu (SOUPS @ USENIX Security Symposium, 2018)

Five Years of the Right to be Forgotten. - Theo Bertram; Elie Bursztein; Stephanie Caro; Hubert Chao; Rutledge Chin Feman; Peter Fleischer; Albin Gustafsson; Jess Hemerly; Chris Hibbert; Luca Invernizzi; Lanah Kammourieh Donnelly; Jason Ketover; et al. (CCS, 2019)

"They Don't Leave Us Alone Anywhere We Go": Gender and Digital Abuse in South Asia. - Nithya Sambasivan; Amna Batool; Nova Ahmed; Tara Matthews; Kurt Thomas; Laura Sanely Gaytán-Lugo; David Nemer; Elie Bursztein; Elizabeth F. Churchill; Sunny Consolvo (CHI, 2019)

Protecting accounts from credential stuffing with password breach alerting. - Kurt Thomas; Jennifer Pullman; Kevin Yeo; Ananth Raghunathan; Patrick Gage Kelley; Luca Invernizzi; Borbala Benko; Tadek Pietraszek; Sarvar Patel; Dan Boneh; Elie Bursztein (USENIX Security Symposium, 2019)

Rethinking the Detection of Child Sexual Abuse Imagery on the Internet. - Elie Bursztein; Einat Clarke; Michelle DeLaune; David M. Elifff; Nick Hsu; Lindsey Olson; John Shehan; Madhukar Thakur; Kurt Thomas; Travis Bright (WWW, 2019)

Evaluating Login Challenges as aDefense Against Account Takeover. - Periwinkle Doerfler; Kurt Thomas; Maija Marincenko; Juri Ranieri; Yu Jiang; Angelika Moscicki; Damon McCoy (WWW, 2019)

Hack for Hire: Exploring the Emerging Market for Account Hijacking. - Ariana Mirian; Joe DeBlasio; Stefan Savage; Geoffrey M. Voelker; Kurt Thomas (WWW, 2019)

Toward Gender-Equitable Privacy and Security in South Asia. - Nithya Sambasivan; Nova Ahmed; Amna Batool; Elie Bursztein; Elizabeth F. Churchill; Laura Sanely Gaytán-Lugo; Tara Matthews; David Nemer; Kurt Thomas; Sunny Consolvo (IEEE Secur. Priv., 2019)

Who is targeted by email-based phishing and malware?: Measuring factors that differentiate risk. - Camelia Simoiu; Ali Zand; Kurt Thomas; Elie Bursztein (Internet Measurement Conference, 2020)

Sunrise to Sunset: Analyzing the End-to-end Life Cycle and Effectiveness of Phishing Attacks at Scale. - Adam Oest; Penghui Zhang; Brad Wardman; Eric Nunes; Jakub Burgis; Ali Zand; Kurt Thomas; Adam Doupé; Gail-Joon Ahn (USENIX Security Symposium, 2020)

Designing Toxic Content Classification for a Diversity of Perspectives. - Deepak Kumar 006; Patrick Gage Kelley; Sunny Consolvo; Joshua Mason; Elie Bursztein; Zakir Durumeric; Kurt Thomas; Michael D. Bailey (SOUPS @ USENIX Security Symposium, 2021)

SoK: Hate, Harassment, and the Changing Landscape of Online Abuse. - Kurt Thomas; Devdatta Akhawe; Michael D. Bailey; Dan Boneh; Elie Bursztein; Sunny Consolvo; Nicola Dell; Zakir Durumeric; Patrick Gage Kelley; Deepak Kumar 006; Damon McCoy; Sarah Meiklejohn; et al. (SP, 2021)

"Why wouldn't someone think of democracy as a target?": Security practices & challenges of people involved with U.S. political campaigns. - Sunny Consolvo; Patrick Gage Kelley; Tara Matthews; Kurt Thomas; Lee Dunn; Elie Bursztein (USENIX Security Symposium, 2021)

"It's common and a part of being a content creator": Understanding How Creators Experience and Cope with Hate and Harassment Online. - Kurt Thomas; Patrick Gage Kelley; Sunny Consolvo; Patrawat Samermit; Elie Bursztein (CHI, 2022)

SoK: A Framework for Unifying At-Risk User Research. - Noel Warford; Tara Matthews; Kaitlyn Yang; Omer Akgul; Sunny Consolvo; Patrick Gage Kelley; Nathan Malkin; Michelle L. Mazurek; Manya Sleeper; Kurt Thomas (SP, 2022)

Understanding Longitudinal Behaviors of Toxic Accounts on Reddit. - Deepak Kumar 006; Jeff T. Hancock; Kurt Thomas; Zakir Durumeric (CoRR, 2022)

Understanding Digital-Safety Experiences of Youth in the U.S. - Diana Freed; Natalie N. Bazarova; Sunny Consolvo; Eunice J. Han; Patrick Gage Kelley; Kurt Thomas; Dan Cosley (CHI, 2023)

"There's so much responsibility on users right now: " Expert Advice for Staying Safer From Hate and Harassment. - Miranda Wei; Sunny Consolvo; Patrick Gage Kelley; Tadayoshi Kohno; Franziska Roesner; Kurt Thomas (CHI, 2023)

"There will be less privacy, of course": How and why people in 10 countries expect AI will affect privacy in the future. - Patrick Gage Kelley; Celestina Cornejo; Lisa Hayes; Ellie Shuo Jin; Aaron Sedley; Kurt Thomas; Yongwei Yang; Allison Woodruff (SOUPS, 2023)

"Millions of people are watching you": Understanding the Digital-Safety Needs and Practices of Creators. - Patrawat Samermit; Anna Turner; Patrick Gage Kelley; Tara Matthews; Vanessia Wu; Sunny Consolvo; Kurt Thomas (USENIX Security Symposium, 2023)

Understanding the Behaviors of Toxic Accounts on Reddit. - Deepak Kumar 006; Jeff T. Hancock; Kurt Thomas; Zakir Durumeric (WWW, 2023)

Robust, privacy-preserving, transparent, and auditable on-device blocklisting. - Kurt Thomas; Sarah Meiklejohn; Michael A. Specter; Xiang Wang; Xavier Llorà; Stephan Somogyi; David Kleidermacher (CoRR, 2023)

Give and Take: An End-To-End Investigation of Giveaway Scam Conversion Rates. - Enze Liu 001; George Kappos; Eric Mugnier; Luca Invernizzi; Stefan Savage; David Tao; Kurt Thomas; Geoffrey M. Voelker; Sarah Meiklejohn (IMC, 2024)

Poisoning Web-Scale Training Datasets is Practical. - Nicholas Carlini; Matthew Jagielski; Christopher A. Choquette-Choo; Daniel Paleka; Will Pearce; Hyrum S. Anderson; Andreas Terzis; Kurt Thomas; Florian Tramèr (SP, 2024)

Understanding Help-Seeking and Help-Giving on Social Media for Image-Based Sexual Abuse. - Miranda Wei; Sunny Consolvo; Patrick Gage Kelley; Tadayoshi Kohno; Tara Matthews; Sarah Meiklejohn; Franziska Roesner; Renee Shelby; Kurt Thomas; Rebecca Umbach (USENIX Security Symposium, 2024)

Privacy Risks of General-Purpose AI Systems: A Foundation for Investigating Practitioner Perspectives. - Stephen Meisenbacher; Alexandra Klymenko; Patrick Gage Kelley; Sai Teja Peddinti; Kurt Thomas; Florian Matthes (CoRR, 2024)

"Perfect is the Enemy of Good": The CISO's Role in Enterprise Security as a Business Enabler. - Kimberly Ruth; Veronica A. Rivera; Gautam Akiwate; Aurore Fass; Patrick Gage Kelley; Kurt Thomas; Zakir Durumeric (CHI, 2025)

MAGIKA: AI-Powered Content-Type Detection. - Yanick Fratantonio; Luca Invernizzi; Loua Farah; Kurt Thomas; Marina Zhang; Ange Albertini; Francois Galilee; Giancarlo Metitieri; Julien Cretin; Alex Petit-Bianco; David Tao; Elie Bursztein (ICSE, 2025)

"We are not Future-ready": Understanding AI Privacy Risks and Existing Mitigation Strategies from the Perspective of AI Developers in Europe. - Alexandra Klymenko; Stephen Meisenbacher; Patrick Gage Kelley; Sai Teja Peddinti; Kurt Thomas; Florian Matthes (SOUPS, 2025)

Integrating Large Language Models into Security Incident Response. - Diana Kramer; Lambert Rosique; Ajay Narotam; Elie Bursztein; Patrick Gage Kelley; Kurt Thomas; Allison Woodruff (SOUPS, 2025)

Supporting Human Raters with the Detection of Harmful Content Using Large Language Models. - Kurt Thomas; Patrick Gage Kelley; David Tao; Sarah Meiklejohn; Owen Vallis; Shunwen Tan; Blaz Bratanic; Felipe Tiengo Ferreira; Vijay Kumar Eranti; Elie Bursztein (SP, 2025)

Help-seeking and Coping Strategies for Technology-facilitated Abuse Experienced by Youth. - Diana Freed; Sunny Consolvo; Dan Cosley; Patrick Gage Kelley; Ender Ricart; Kurt Thomas; Natalie N. Bazarova (Proc. ACM Hum. Comput. Interact., 2025)

Supporting the Digital Safety of At-Risk Users: Lessons Learned from 9+ Years of Research and Training. - Tara Matthews; Elie Bursztein; Patrick Gage Kelley; Lea Kissner; Andreas Kramm; Andrew Oplinger; Andreas Schou; Manya Sleeper; Stephan Somogyi; Dalila Szostak; Kurt Thomas; Anna Turner; et al. (ACM Trans. Comput. Hum. Interact., 2025)