--- title: CAPTCHA The Latest Target for Hackers description: CAPTCHAs have become a concern as hackers have found ways to spoof them image: https://blog.axisins.com/hubfs/Untitled%20design%20(1).jpg --- [![AxisInsurance](https://blog.axisins.com/hubfs/files_2023/logo.png)](https://www.axisins.com/) Connect with us Call us Today [(201) 847-9175](tel:2018479175) [(877) 787-5258](tel:8777875258) - - About Axis - [Our Approach](https://www.axisins.com/about-us/) - [Our Team](https://www.axisins.com/our-team/) - [Testimonials](https://www.axisins.com/testimonials/) - [Case Studies](https://www.axisins.com/case-studies/) - [News & Events](https://blog.axisins.com/tag/news-and-events) - [Careers](https://www.axisins.com/job-opportunities/) - Product Lines - [Overview](https://www.axisins.com/products/) - [On-line Quoting](https://www.axisins.com/products/on-line-quoting/) - [Surety Bonds](https://www.axisins.com/products/surety-bonds/) - [Cyber Liability/Privacy & Network Security](https://www.axisins.com/products/cyber-liability-privacy-network-security/) - [Overview](https://www.axisins.com/products/cyber-liability-privacy-network-security/) - [Tail Coverage Insurance](https://www.axisins.com/products/tail-coverage-insurance/) - [Why Cyber Liability](https://www.axisins.com/products/cyber-liability-privacy-network-security/why-cyber-liability/) - [Cyber Hotline/Resources](https://www.axisins.com/products/cyber-liability-privacy-network-security/cyber-hotline-resources/) - [Claims Scenarios](https://www.axisins.com/products/cyber-liability-privacy-network-security/claims-scenarios/) - [Professional Liability Insurance (E&O)](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/) - [Overview](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/) - [Tail Coverage Insurance](https://www.axisins.com/products/tail-coverage-insurance/) - [Professions](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/professions/) - [Insurance](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/insurance-agents-brokers/) - [Legal](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/legal/) - [Real Estate](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/real-estate-agents-brokers/) - [Technology](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/technology/) - [Healthcare/Medical](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/healthcare-medical-practice/) - [Architects & Engineers](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/architects-engineers/) - [Financial Institutions](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/financial-institutions/) - [Construction](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/construction/) - [Consulting](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/consulting/) - [Media](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/media/) - [Mortgage Bankers & Brokers](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/mortgage-bankers-brokers/) - [Miscellaneous Services](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/miscellaneous-services/) - [Resources](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/resources/) - [Claims Scenarios](https://www.axisins.com/products/errors-omissions-professional-liability-insurance/claims-scenarios/) - [Management Liability Insurance (D&O)](https://www.axisins.com/products/management-liability-insurance-do/) - [Overview](https://www.axisins.com/products/management-liability-insurance-do/) - [Tail Coverage Insurance](https://www.axisins.com/products/tail-coverage-insurance/) - [Claims Scenarios](https://www.axisins.com/products/management-liability-insurance-do/claims-scenarios/) - [Resources](https://www.axisins.com/products/management-liability-insurance-do/resources/) - [Employment Practices Liability Insurance](https://www.axisins.com/products/employment-practices-liability-insurance/) - [Overview](https://www.axisins.com/products/employment-practices-liability-insurance/) - [Tail Coverage Insurance](https://www.axisins.com/products/tail-coverage-insurance/) - [Claims Scenarios](https://www.axisins.com/products/employment-practices-liability-insurance/claims-scenarios/) - [Resources](https://www.axisins.com/products/employment-practices-liability-insurance/resources/) - [Crime Insurance](https://www.axisins.com/products/crime-insurance/) - [Overview](https://www.axisins.com/products/crime-insurance/) - [Claims Scenarios](https://www.axisins.com/products/crime-insurance/claims-scenarios/) - [Resources](https://www.axisins.com/products/crime-insurance/resources/) - [Fiduciary Liability](https://www.axisins.com/products/fiduciary-liability/) - [Overview](https://www.axisins.com/products/fiduciary-liability/) - [Claims Scenarios](https://www.axisins.com/products/fiduciary-liability/claims-scenarios/) - [Resources](https://www.axisins.com/products/fiduciary-liability/resources/) - [FAQs](https://www.axisins.com/faqs/) - Client Resources - [Make a Payment](https://axisins.epaypolicy.com/) - [Apps & Forms](https://www.axisins.com/client-resources/apps-forms/) - [Report A Claim](https://www.axisins.com/client-resources/report-a-claim/) - [Request A Certificate of Insurance](https://www.axisins.com/client-resources/request-a-certificate-of-insurance/) - [Blog](https://blog.axisins.com/) - [Contact Us](https://www.axisins.com/contact-us/) -   CALL US TODAY [(877) 787-5258](tel:8777875258) ## Keeping you up to date on trends, emerging exposures and other critical issues. [Subscribe To Our Blog](https://share.hsforms.com/18qZLml0MTSqtYWBFqQFAGA35dv4?__hstc=172306556.605fbd816f522e1de3e9428cb969d5b4.1580877711545.1580973215492.1580978435349.10&__hssc=172306556.3.1580978435349&__hsfp=1035641285) # CAPTCHA The Latest Target for Hackers May 5, 2025 ![](https://blog.axisins.com/hubfs/Untitled%20design%20(1).jpg) Drew Smith Cyber criminals are constantly ahead of the curve on many things that most people take for granted in cyberspace. In recent months, a new type of hack has made people question how to protect their identities and enter websites when specific processes, such as CAPTCHA, are now in question. CAPTCHA, or the Completely Automated Public Turing Test, is designed with bots and computers in mind. The idea is simple: some things bots and AI cannot recognize, such as specific phrases, letters, and words. The words are jumbled up and distorted in the classic CAPCHAS now being phased out. Early bots could not figure out the difference or find the correct letters, while humans, able to discern patterns, could thus reveal who’s a bot and who isn’t. Users often encounter CAPTCHA and reCAPTCHA tests on the Internet. Such tests are one way of [managing bot activity](https://www.cloudflare.com/learning/bots/what-is-bot-management/), although the approach has its drawbacks. In a twist of irony, this process is also automated by the websites running these programs. [(1)](https://www.cloudflare.com/learning/bots/how-captchas-work/) As with anything, these have drawbacks, chief among them user experience. Users of websites with CAPTCHAS say it distracts them from the website's experience and hurts engagement and click-through rates. In addition, it is not set up correctly for visually impaired people who can’t operate a keyboard without assistance. Some do offer hearing-based tests, but many don’t, which compounds the user experience issue. [(2)](https://www.anura.io/captcha) Like anything, CAPTCHAs can and have been spoofed, and two recent cases show the vulnerability of such a system. In September 2024, OPENAI, the world’s leading AI service, shut down the source key for several malicious actors after they discovered they were using it to spoof CAPTCHAs. The bot program, called the AkiraBot is a bot that uses its software to mimic actual customers through the Shopify app. "AkiraBot has targeted more than 400,000 websites and successfully spammed at least 80,000 websites since September 2024," SentinelOne researchers Alex Delamotte and Jim Walter [said](https://www.sentinelone.com/labs/akirabot-ai-powered-bot-bypasses-captchas-spams-websites-at-scale/) in a report shared with The Hacker News. "The bot uses OpenAI to generate custom outreach messages based on the website's purpose." Another notable aspect of the service is that it can get around CAPTCHA barriers to spam websites at scale and evade network-based detections by relying on a proxy service that's typically offered to advertisers. The targeted CAPTCHA services consist of hCAPTCHA, reCAPTCHA, and Cloudflare Turnstile. More worryingly, hackers have found a way to use this bot detection software to steal your information. The attack chain is deceptively simple. It uses familiar CAPTCHA interfaces to execute scripts, which makes it highly effective because of its seemingly benign nature. The incidents we investigated typically followed the sequence below: 1. **Malicious Redirect:**A web user visits a compromised website and is redirected to another webpage, where they’re presented with a familiar and seemingly harmless CAPTCHA challenge 2. **JavaScript Clipboard Hijack:**Simply by visiting the website, a malicious command is silently copied to the user’s clipboard via JavaScript, without their knowledge. 3. **Unusual Run Prompt:**Instead of clicking how many traffic lights or bridges they see, the user is instructed to open a Run prompt Windows feature for quickly executing commands, opening programs, and accessing files—and paste the pre-copied command, unknowingly running the malicious script. 4. **Malware Installation:**The command leads to the installation of malware, often resulting in credential theft, as login details for systems, applications, and services are harvested and sent to attackers.[(4)](https://reliaquest.com/blog/using-captcha-for-compromise/) These are successful because most people think CAPTCHA is just a click-and-move-on feature. When they get these prompts, they inadvertently enter them without thinking, infecting your computer. The simple reason being why waste time hacking a victim’s computer when they can do it for you. Most websites use CAPTCHAs to separate their customers from bots masquerading as them. Though not perfect, the system can work if people pay attention. However, like with anything cyber-related, it can be turned around and abused if websites aren’t careful. [Axis Insurance Service will be Sponsoring Booth at CIAANJ Seminar](https://blog.axisins.com/axis-insurance-service-will-be-sponsoring-booth-at-ciaanj-seminar) [Celebrating the Journey of Matt Culkin at Axis Insurance Services and PLRisk Specialty Insurance Agency](https://blog.axisins.com/celebrating-the-journey-of-matt-culkin-at-axis-insurance-services-and-plrisk-specialty-insurance-agency) Search ### Share this post [![Share on facebook](https://7528309.fs1.hubspotusercontent-na1.net/hub/7528309/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/facebook-color.png?width=24&name=facebook-color.png)](http://www.facebook.com/share.php?u=https%3A%2F%2Fblog.axisins.com%2Fcaptcha-the-latest-target-for-hackers%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/linkedin-color.png?width=24&name=linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fblog.axisins.com%2Fcaptcha-the-latest-target-for-hackers%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/x-twitter-color.png?width=24&name=x-twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fblog.axisins.com%2Fcaptcha-the-latest-target-for-hackers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fblog.axisins.com%2Fcaptcha-the-latest-target-for-hackers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://7528311.fs1.hubspotusercontent-na1.net/hub/7528311/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/email-color.png?width=24&name=email-color.png)](mailto:?subject=Check%20out%20https%3A%2F%2Fblog.axisins.com%2Fcaptcha-the-latest-target-for-hackers%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fblog.axisins.com%2Fcaptcha-the-latest-target-for-hackers%3Futm_medium%3Dsocial%26utm_source%3Demail) ### Recent Posts ### Categories - [E&O (19)](https://blog.axisins.com/tag/eo) - [Cannabis (11)](https://blog.axisins.com/tag/cannabis) - [Company News (1)](https://blog.axisins.com/tag/company-news) ![AxisInsurance](https://blog.axisins.com/hubfs/files_2023/art2.png) ### Connect to Our Cyber Hotline & Resources [Connect](https://www.axisins.com/products/cyber-liability-privacy-network-security/cyber-hotline-resources/) Please see our [Privacy Policy](https://www.axisins.com/privacy-policy) to understand how Axis Insurance Services handles your personal information. California Residents are entitled to specific rights which can be outlined on our Notice for [California Residents](https://www.axisins.com/california-privacy-policy). You may request information regarding our privacy policy or update your preferences by contacting us directly at 201-847-9175 or by completing the Request for Information on [Privacy form](https://info.axisins.com/axis-request-for-information-on-privacy). ### Schedule a Consultation ### Stay tuned with us on social networks! [![AxisInsurance](https://blog.axisins.com/hubfs/files_2023/logo.png)](https://www.axisins.com/) 795 Franklin Avenue, Suite 210 Franklin Lakes, NJ 07417 Phone: [201-847-9175](tel:2018479175) Fax: 201-847-9174 [www.axisins.com](http://www.axisins.com/) ### Quick Navigation - [Home](https://www.axisins.com/) - [About Axis](https://www.axisins.com/about-us/) - [FAQs](https://www.axisins.com/faqs/) - [Blog](https://www.axisins.com/blog/) - [Site Map](https://www.axisins.com/site-map/) - [Contact Us](https://www.axisins.com/contact-us/) - [Privacy Policy](https://www.axisins.com/privacy-policy/) - [Terms & Conditions](https://www.axisins.com/terms-conditions/) - [Accessibility Statement](https://www.axisins.com/accessibility-statement/) - [State Licenses](https://www.axisins.com/state-licenses/) Copyright ©2022 – 2024, Axis Insurance Services, LLC In California and Texas as NJ Axis Insurance Services, LLC. In Illinois as Axis Insurance Services of New Jersey, LLC. In New York as NJ Axis Insurance Agency New Jersey Corporate License #OP-9948294. California Corporate License #OD-79693. Axis Insurance Services, LLC is not affiliated with Axis Insurance Company, Axis Capital, its subsidiaries, or affiliates in any way.