VulnHub

Real-time Cybersecurity News

Fake CAPTCHA Scam Abuses Verification Clicks to Send Costly International Texts

Hackread – Cybersecurity News, Data Breaches, AI and More
Actively Exploited

Overview

A recent study by Infoblox has uncovered a widespread scam that exploits fake CAPTCHA prompts and manipulates users into sending expensive international text messages. This Click2SMS fraud scheme tricks victims into believing they are completing a verification process, only to find themselves unknowingly agreeing to send costly texts to foreign numbers. The scam primarily targets unsuspecting individuals who may not be aware of the potential charges associated with these messages. As a result, this scheme poses a financial risk to users who fall victim to it. Awareness and caution are essential for individuals navigating online services that require CAPTCHA verification.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Users tricked into sending international text messages
  • Action Required: Users should be cautious of unsolicited CAPTCHA requests and verify the legitimacy of the service before proceeding.
  • Timeline: Newly disclosed

Original Article Summary

Research from Infoblox reveals a massive Click2SMS fraud scheme using fake CAPTCHAs and back button hijacking to trick victims into sending costly international texts.

Impact

Users tricked into sending international text messages

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should be cautious of unsolicited CAPTCHA requests and verify the legitimacy of the service before proceeding.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

Researchers Uncover Pre-Stuxnet ‘fast16’ Malware Targeting Engineering Software

The Hacker News

Researchers at SentinelOne have discovered a previously unknown malware framework called 'fast16,' which dates back to 2005. This Lua-based malware was designed to target high-precision calculation software, which is often used in engineering and industrial applications. The malware predates the infamous Stuxnet worm, which was aimed at disrupting Iran's nuclear program. The implications of fast16 are significant as it shows that cyber sabotage efforts have been in play for much longer than previously thought, raising concerns about the security of critical infrastructure and industrial systems. Companies using this type of software need to be aware of the potential risks and take steps to protect their systems.

Apr 25, 2026

12-year-old Pack2TheRoot bug lets Linux users gain root privileges

Security Affairs

A vulnerability known as 'Pack2TheRoot,' tracked as CVE-2026-41651, has been identified in Linux systems, allowing local users to gain root privileges without authorization. This flaw has existed for nearly 12 years and has been rated with a high severity score of 8.8. It enables unprivileged users to install or remove system packages, which could lead to complete control over the system. This issue affects any Linux distribution that utilizes PackageKit, making it a significant concern for users and administrators alike. Given the potential for exploitation, it is crucial for affected parties to take immediate action to secure their systems.

Apr 24, 2026

New BlackFile extortion group linked to surge of vishing attacks

BleepingComputer

A new hacking group known as BlackFile has emerged, targeting retail and hospitality organizations since February 2026. This group is primarily focused on data theft and extortion, escalating the risk for businesses in these sectors. Researchers found that BlackFile's tactics include vishing attacks, where attackers use phone calls to manipulate victims into revealing sensitive information. The implications of this surge are significant, as it not only threatens the financial stability of affected companies but also jeopardizes customer data and trust. As organizations in retail and hospitality deal with these threats, they need to enhance their security measures and employee training to mitigate the risks associated with such attacks.

Apr 24, 2026

New ‘Pack2TheRoot’ flaw gives hackers root Linux access

BleepingComputer

A newly discovered vulnerability known as Pack2TheRoot poses a significant risk to Linux systems by allowing local users to gain root access through the PackageKit daemon. This flaw enables unauthorized users to install or remove system packages, potentially compromising the integrity of the system. The vulnerability could be exploited by anyone with local access to a vulnerable Linux machine, making it a concern for both individual users and organizations that rely on Linux environments. As the flaw can lead to full control over the system, it is crucial for affected users to take immediate action to mitigate risks and secure their systems. Researchers are urging users to monitor their systems closely until a patch is available.

Apr 24, 2026

US Busts Myanmar Ring Targeting US Citizens in Financial Fraud

darkreading

U.S. authorities have charged 29 individuals, including a Cambodian senator, for their involvement in a financial fraud scheme targeting American citizens. The operation was centered around a network of fake investment websites, leading to the seizure of over 500 web domains associated with these scams. This crackdown highlights the growing issue of international fraud affecting U.S. residents, particularly as scammers increasingly utilize online platforms to deceive victims. The involvement of a foreign official raises concerns about the extent of these operations and their potential links to organized crime. Law enforcement's swift action is intended to protect citizens from further financial loss and deter similar schemes in the future.

Apr 24, 2026

Cambodian senator, others hit with US sanctions over scam allegations

SCM feed for Latest

The U.S. Treasury Department has imposed sanctions on Cambodian Senator Kok An and 28 other individuals and organizations due to their alleged roles in facilitating scam operations. The sanctions aim to disrupt these activities, which often involve fraud and deception targeting individuals and businesses. This action is part of a broader effort to combat international scams and protect potential victims from financial loss. The implications of these sanctions extend beyond Cambodia, as they signal a commitment from the U.S. to tackle global cybercrime and hold accountable those who enable such operations. By targeting key figures in these scams, authorities hope to deter similar activities in the future.

Apr 24, 2026