Phishing Threat Uses CAPTCHAs to Hack Accounts

Global

Global - English

Asia

Europe

Oceania

ANZ - English

Latin America

North America

Middle East and Africa

Cancel

Reset

Submit

Three Tips from Hikvision to Avoid Becoming a Victim of CAPTCHA Phishing Hacks

Cybercriminals are using CAPTCHA phishing to hack accounts, according to the SC Magazine article, “Phishing pages leverage CAPTCHAs to fool users, evade detection.”

CAPTCHAs, also known as reCAPTCHAS, are typically used on legitimate websites as a way to verify that a visitor is a human, not a robot.

“Users have undoubtedly become familiar with CAPTCHAs through the regular use of the web, so a CAPTCHA can preserve the illusion of normality when users click links offered to them in phishing emails,” said principal researcher for KnowBe4, Eric Howes, in the SC Magazine article.

The story offered a few suggestions to identify fraudulent or phishing CAPTCHAs to prevent becoming a victim. These included identifying:

CAPTCHAs on a blank website background, which are often suspicious.
CAPTCHAs on a website that doesn’t typically use them (i.e. Microsoft login pages).

Hikvision on CAPTCHA Phishing Examples
Hikvision’s senior director of cybersecurity, Chuck Davis, covered this hacking method in a recent blog, “Examples of reCAPTCHAS Hacks and Phishing Threats, Plus 4 Tips to Avoid Becoming a Victim to these Cyberattacks.” It becomes a “bait and switch” where a valid method from legitimate sites is used to trick visitors into disclosing information.

“What this means is that if you are tricked into clicking on a link or opening an attachment from a phishing email, you might be met with a real, reCAPTCHA challenge which has you check a box to prove that you are not a robot. In this context, a ‘robot’ or a ‘bot’ is an automated program that scours the Internet looking to scrape data from sites, create fake accounts or post fake reviews. When you click that box and pass the reCAPTCHA test, you are sent to the malicious phishing page. While clicking that box is an easy test for humans, the automated cybersecurity tools that check the links in our email work much like the malicious bots and are unable to get past that reCAPTCHA to determine if the page has suspicious or malicious content,” said Davis, in the Hikvision article.

Three Tips to Avoid Being a Victim of this CAPTCHA Scam

Follow standard phishing detection recommendations.
Don’t leave your guard down when you see something that looks credible, like a reCAPTCHA.
Use a password manager and have it automatically fill in your username and password. If you’re on a phishing site, it won’t paste your credentials into an unrecognized domain, for example microsoft.com versus miicrosoft.com.