TZUTC: -0500   
   MSGID: 958.consprcy@1:2320/105 2c5d1969   
   PID: Synchronet 3.20a-Linux master/acc19483f Apr 26 202 GCC 12.2.0   
   TID: SBBSecho 3.20-Linux master/acc19483f Apr 26 2024 23:04 GCC 12.2.0   
   BBSID: CAPCITY2   
   CHRS: ASCII 1   
   AkiraBot network hits thousands of sites with CAPTCHA bypassing AI spam   
      
   Date:   
   Thu, 10 Apr 2025 10:30:00 +0000   
      
   Description:   
   Tens of thousands of websites were served spam messages in chat, comment   
   sections, and more.   
      
   FULL STORY   
      
   A major spam campaign leveraging ChatGPT targeted more than 400,000 websites   
   and successfully spammed 80,000, even working around CAPTCHA filters to   
   advertise shady services.    
      
   This is according to cybersecurity researchers SentinelOne, who discovered    
   the campaign and recently wrote an in-depth report about it.    
      
   As per the report, at the center of the campaign is a platform called    
   AkiraBot that targets website chats, comment sections, and contact forms. It   
   is not related to the ransomware operation of the same name.    
      
   Cracking CAPTCHA    
      
   It is a Python-based framework which uses an OpenAI API to create spam   
   contents related to the general purpose of the website being targeted. The   
   goal of the campaign is to advertise two dubious search engine optimization   
   (SEO) services, called Akira and ServicewrapGO.    
      
   What makes this spam campaign stand out is the way it works around CAPTCHA   
   spam filters.    
      
   The bot creator has invested significant effort into evading CAPTCHA filters   
   as well as avoiding network detections by relying on a proxy service    
   generally marketed towards advertisersthough the service has had considerable   
   interest and use by cybercriminal actors, the researchers said in their   
   report.    
      
   To bypass CAPTCHA, the bot uses fake web browsers that mimic a real persons   
   browser behavior. It does this using a tool called Selenium, which is capable   
   of opening websites and clicking around.    
      
   Since websites can usually spot fake browsers (by hunting for clues such as   
   missing fonts, mismatched browser info, etc.), the bot injects special code   
   (inject.js) into the website as it loads. This code tweaks how the fake   
   browser looks, making it seem more human.    
      
   If this browser trick still doesnt fool the CAPTCHA, the bot then uses   
   external CAPTCHA-solving services (like Capsolver) to crack it. It even   
   targets chat systems on websites (like Reamaze) to refresh tokens and keep   
   spamming undetected.    
      
   SentinelOne believes AkiraBot has been in use since at least September 2024,   
   targeting GoDaddy, Wix, Squarespace, and other websites.    
      
   According to The Hacker News, OpenAI has disabled the API key and other   
   associated assets the threat actors used, to tackle the threat.    
      
   "The author or authors have invested significant effort in this bot's ability   
   to bypass commonly used CAPTCHA technologies, which demonstrates that the   
   operators are motivated to violate service provider protections," the   
   researchers said.    
      
   "AkiraBot's use of LLM-generated spam message content demonstrates the   
   emerging challenges that AI poses to defending websites against spam    
   attacks."    
      
    Via The Hacker News   
      
   ======================================================================   
   Link to news story:   
   https://www.techradar.com/pro/security/akirabot-network-hits-thousands-of-site   
   s-with-captcha-bypassing-ai-spam   
      
   $$   
   --- SBBSecho 3.20-Linux   
    * Origin: capitolcityonline.net * Telnet/SSH:2022/HTTP (1:2320/105)   
   SEEN-BY: 105/81 106/201 128/187 129/305 153/7715 154/110 218/700 226/30   
   SEEN-BY: 227/114 229/110 111 114 206 300 307 317 400 426 428 470 664   
   SEEN-BY: 229/700 705 266/512 291/111 320/219 322/757 342/200 396/45   
   SEEN-BY: 460/58 712/848 902/26 2320/0 105 3634/12 5075/35   
   PATH: 2320/105 229/426