Malefactors have also tried to bypass legitimate CAPTCHAs for the purpose of conducting attack campaigns. In February 2018, My Online Security observed a campaign that used an image pretending to be a Google reCAPTCHA to download a malicious ZIP file. Back in 2016, researchers at the University of Connecticut and Bar Ilan University identified a malicious attack in which threat actors could trick users into divulging some of their personal information by completing a fake CAPTCHA. This isn’t the first time threat actors have incorporated CAPTCHAs into their attack campaigns. A History of Abusing and Bypassing CAPTCHAs Otherwise, it would download a malicious ZIP archive. If it found the victim was using an Android device, the attack would load a malicious APK file capable of intercepting two-factor authentication (2FA) codes. It also did not support audio replay.Īt that point, the PHP code checked the victim’s browser user-agent to determine what payload it should deliver. This feature used static HTML and JavaScript, so was not capable of rotating the individual images used in each authentication test. If passed through a user-agent filter, the PHP code loaded a fake Google reCAPTCHA. That file was responsible for loading a fake 404 error page for visitors that had specifically defined user-agents. Digital attackers deployed this disguise in the hopes that employees at the targeted bank would click on a link to a malicious PHP file out of alarm.

Sucuri researchers discovered that the campaign sent out malicious emails masquerading as a confirmation for a recent transaction. A recent phishing campaign used a fake Google reCAPTCHA as part of its efforts to target Polish bank employees with malware.

Google recaptcha bypass 2016