NEW SMS SCAM ALERT: Fake CAPTCHA Pages Are Hijacking Your Phone to Trigger 60 Hidden International SMS Charges + Video

By /

Listen to this Post

Featured Image

Introduction:

Every day, millions of users complete CAPTCHA challenges to prove they are human, a routine web interaction that has become second nature. However, cybercriminals are now weaponizing this trust by creating fake CAPTCHA pages that appear legitimate but are actually designed to silently trigger up to 60 premium-rate international SMS messages per victim, adding hidden charges to phone bills without the user’s knowledge. This sophisticated social engineering scheme exploits International Revenue Share Fraud to turn routine verification into a profitable scam that has already infected thousands of devices worldwide.

Learning Objectives:

  • Understand how fake CAPTCHA pages weaponize user trust to trigger hidden international SMS charges through International Revenue Share Fraud
  • Learn step-by-step detection and prevention techniques for individuals, including mobile configuration hardening for both iOS and Android devices
  • Master technical mitigation strategies for enterprises, including API security controls and real-time traffic monitoring to protect SMS verification endpoints

You Should Know:

  1. How the Fake CAPTCHA SMS Pumping Attack Works

The attack begins when a user lands on a compromised or lookalike website that loads a traffic distribution system (TDS). This TDS fingerprints the visitor’s browser, language, and device type before redirecting them through multiple intermediate nodes to a fake CAPTCHA page designed to closely mimic legitimate verification flows. Unlike real CAPTCHAs, which never ask users to send messages, the fake page presents a “verification step” that prompts the user to confirm they are human by sending an SMS. When the user follows the instructions, their device’s messaging app opens with pre-filled text and a list of premium-rate international numbers spanning countries such as Azerbaijan, Egypt, Myanmar, the Netherlands, and Kazakhstan—each carrying high termination fees that maximize the attacker’s payout per session.

In one observed flow, four CAPTCHA steps triggered 60 outbound SMS messages during a single “verification” session, costing the victim approximately 30 USD. Because international SMS charges often appear on bills weeks later, many victims never connect these unexpected fees to the forgotten CAPTCHA they completed days earlier. The back button is also hijacked via JavaScript, trapping users in a loop that prevents them from navigating away unless they close the browser entirely.

Step‑by‑step breakdown of the attack:

  1. The victim visits a legitimate or lookalike website that has been compromised by the attacker.
  2. The site loads a malicious script that redirects the user through a TDS network of multiple nodes.
  3. The TDS analyses the victim’s geolocation, IP address, language, and other identifiers to select the most lucrative scam payload.
  4. The user lands on a fake CAPTCHA page that mimics Cloudflare or other trusted verification interfaces.
  5. The page presents steps instructing the user to open their messaging app and send SMS to a provided list of international numbers.
  6. Each SMS sent generates revenue for the fraudster through International Revenue Share Fraud arrangements with telecom providers.
  7. The page may loop the victim through multiple iterations, triggering dozens of charges in a single visit.

  8. Detection Techniques for Individuals: Spotting a Fake CAPTCHA

Legitimate CAPTCHA verifications never require users to send SMS messages, run commands, enable browser notifications, or download additional software. If a verification prompt asks you to perform any of these actions, it is almost certainly a scam. Attackers increasingly rely on urgency tactics such as countdown timers, live visitor counters, and embedded tutorial videos to pressure victims into acting quickly without thinking.

Red flags that indicate a fake CAPTCHA include: a URL that does not match the expected domain (for example, a CAPTCHA appearing on a site that should not require one), instructions that involve using keyboard shortcuts (such as Win + R) followed by paste actions, and any request to send an SMS or provide personal information as part of the verification process. Users should verify the legitimacy of any unexpected CAPTCHA by checking the website’s official documentation or contacting support before proceeding.

Step‑by‑step guide to manual detection and smartphone hardening:

For iOS users:

  1. Go to Settings → Messages and enable Filter Unknown Senders to automatically separate messages from unknown numbers into a distinct tab.
  2. Under Settings → Phone → Silence Unknown Callers, enable the feature to automatically send unknown calls to voicemail.
  3. Contact your mobile carrier to request a block on all premium-rate international SMS sending capabilities.
  4. If your carrier supports it, use their official app (such as SafeHub+ on StarHub) to toggle Block Overseas SMSes under the Cyber Security section.

For Android users:

  1. Open Google Messages → Settings → Spam Protection and enable both See & delete spam and Auto-block suspected spam.
  2. In the messaging app settings, add international country codes (such as +1 for USA, +44 for UK) to your blocklist or custom filtering rules.
  3. Install an AI-powered protection app such as Avast Mobile Security, which includes SMS Guard to automatically detect and block suspicious text-based scam attempts.
  4. Dial your carrier’s barring code (for example, `21` followed by the number) to disable international SMS sending. Check with your provider for the exact shortcode appropriate for your region and plan.

3. Backend Mechanics: International Revenue Share Fraud

International Revenue Share Fraud is the engine that powers this scam. Attackers register or lease premium-rate phone numbers in high‑fee or lightly regulated destinations and sign revenue‑sharing deals with local carriers. When a victim sends an international SMS to one of these numbers, their home carrier pays a termination fee to the foreign operator, who then shares a cut of that fee with the fraudster. The scam does not require any software vulnerability; it simply exploits standard telecom billing infrastructure.

Industry data shows that artificially inflated traffic, which includes IRSF-generated messaging, is now ranked as the most financially damaging form of messaging fraud worldwide, with roughly half of telecom carriers reporting high financial losses due to fraudulent traffic volumes. On the enterprise side, a single successful IRSF campaign can drain hundreds of thousands of dollars from a company’s SMS budget within minutes. Attackers now execute “Flash Attacks” using high-speed cloud infrastructure to trigger hundreds of thousands of SMS requests within a ten‑minute window, bypassing traditional rate limits that rely on simple IP‑based detection.

Step‑by‑step guide for enterprise prevention:

Implement rate limiting and geo‑blocking:

  • Enforce strict rate limits on verification endpoints: per IP address, per phone number, and per session. This prevents automated scripts from flooding your endpoints.
  • Block all international numbers in countries where your business does not operate. Configure your SMS API to reject requests targeting those country codes.

Deploy CAPTCHA and behavioral analytics:

  • Use Google reCAPTCHA Enterprise, which assigns a risk score to each phone number based on Google‑scale fraud intelligence, helping to identify numbers involved in SMS toll fraud.
  • Implement behavioral analytics that track mouse movement acceleration, typing speed, and other interaction patterns. Bots often exhibit “perfect” or rhythmic patterns, allowing the system to flag the request before the Send SMS button is even clicked.

Monitor for anomalies:

  • Set up real‑time alerts for sudden spikes in SMS volume without corresponding user growth, and monitor for high message counts directed to specific country codes.
  • Investigate low conversion rates on verification flows, which indicate messages are being sent but never successfully verified by the recipient.

Example Python snippet for rate limiting using Redis (Flask):

import redis
from flask import request, jsonify

redis_client = redis.Redis(host='localhost', port=6379, decode_responses=True)

def check_rate_limit(identifier, limit=5, window=60):
current = redis_client.incr(identifier)
if current == 1:
redis_client.expire(identifier, window)
return current <= limit

@app.route('/send-sms', methods=['POST'])
def send_sms():
ip = request.remote_addr
phone = request.json.get('phone')
if not check_rate_limit(f"sms:{ip}"):
return jsonify({"error": "Rate limit exceeded"}), 429
if not is_allowed_country(phone):
return jsonify({"error": "International SMS blocked"}), 403
 Proceed with sending SMS
return jsonify({"status": "sent"})

4. Advanced Malware Chains: The ClickFix Evolution

Fake CAPTCHA pages are no longer limited to SMS pumping. A more dangerous variant known as ClickFix delivers malware by tricking users into executing malicious commands directly on their own machines. These campaigns tell victims to press Win + R, paste a command (which the website has silently copied to the clipboard), and press Enter—all under the guise of a routine CAPTCHA verification. The command often runs PowerShell or VBScript that downloads and executes infostealers such as Lumma Stealer, StealC, or Atomic Stealer, granting attackers immediate code execution capabilities.

Recent iterations of ClickFix have become even more sophisticated, including embedded video tutorials that show exactly how to run the malicious code and automatic operating system detection that copies the appropriate command for the victim’s OS to the clipboard, reducing the chance of user error and making infection more certain. This technique, which researchers call “Living Off the Web,” does not replace traditional lures but rather compounds them, abusing the mechanics of everyday internet interactions such as CAPTCHAs, browser notifications, and update prompts as shared delivery surfaces.

Step‑by‑step guide for enterprise detection and response:

  • Monitor PowerShell execution: Configure endpoint detection and response systems to log and alert on PowerShell execution initiated from the Run dialog (Win + R) rather than from typical system processes.
  • Restrict clipboard access: Implement browser policies that limit clipboard read access from untrusted origins and monitor for unusual copy‑paste patterns followed by command execution.
  • Deploy application whitelisting: Use AppLocker or similar tools to allow only signed, approved scripts and executables, blocking malicious PowerShell commands that are typically unsigned and executed from user directories.
  • Educate users: Train employees never to run commands or scripts copied from websites, emails, or messages unless they have independently verified the instructions through official channels.
  1. Incident Investigation: How to Trace Unusual SMS Charges

When unexpected international SMS charges appear on a phone bill, victims should first contact their mobile carrier to request detailed usage logs. These logs typically include timestamps, destination numbers, and the cost per message, which can help identify the specific premium‑rate numbers involved in the scam. Save all suspicious phone numbers, URLs, and screenshots of the fake CAPTCHA page before closing the browser, as this evidence will be needed when reporting the incident to both the carrier and local authorities.

For forensic analysis, users can check browser history to locate the referrer domain of the fake CAPTCHA page. The attack chain often begins with a typosquatted domain or a compromised legitimate site that redirects through multiple TDS nodes. Investigators should look for patterns such as repeated requests to numbers in high‑risk country codes and correlate those with the timestamps in the SMS logs. Carriers may offer to block these premium numbers retroactively and sometimes issue credits for fraudulent charges, though recovery is not guaranteed.

Step‑by‑step guide to forensic data collection:

On a Windows machine:

  1. Open Event Viewer and navigate to Applications and Services Logs → Microsoft → Windows → PowerShell → Operational to review PowerShell script block logs for any suspicious execution around the time of the incident.
  2. Examine the clipboard history: Press Win + V to open Clipboard History (if enabled) to see what text was recently copied from the browser.
  3. Retrieve browser history from Chrome ( %LocalAppData%\Google\Chrome\User Data\Default\History ) or Firefox ( %AppData%\Mozilla\Firefox\Profiles\ ) and look for entries leading to fake CAPTCHA domains.

On a mobile device:

  1. On Android, open Settings → Google → Manage your Google Account → Data & privacy → My Activity to review recent web and app activity that may have led to the scam page.
  2. On iOS, go to Settings → Screen Time → See All Activity and scroll down to Website Usage to identify suspicious visited domains.
  3. Use carrier‑provided apps or request a detailed SMS log from customer support. Save the log as a PDF or screenshot for evidence.

6. Training and Awareness for Security Teams

The increase of 563% in fake CAPTCHA attacks over 2025 highlights an urgent need for updated security awareness training that goes beyond traditional email phishing simulations. Modern training programs must cover smishing, vishing, and web‑based social engineering in a multi‑vector approach that realistically simulates the conditions users face in everyday online interactions. In 2026, the most effective training platforms help organizations train employees across all three vectors with realistic phishing, smishing, and vishing simulations.

Organizations can reduce their exposure by conducting regular phishing simulation campaigns that specifically include verification‑themed lures, conditioning employees to question unexpected prompts before interacting. Training curricula should incorporate real‑world case studies of fake CAPTCHA campaigns alongside psychological manipulation techniques used by fraudsters, such as urgency tactis and trust exploitation. Security teams should also develop and rehearse incident response playbooks that specifically address the detection, containment, and remediation of ClickFix‑style attacks.

Recommended training modules for security professionals:

  • Module 1: Social Engineering 2.0 – Understanding phishing, smishing, vishing, and pretexting in modern threat landscapes.
  • Module 2: CAPTCHA Weaponization – Technical deep dive into fake CAPTCHA infrastructure, including TDS analysis and IRSF mechanics.
  • Module 3: Endpoint Behavioral Detection – Monitoring for unusual command execution patterns, clipboard manipulation, and PowerShell anomalies.
  • Module 4: Incident Response for SMS Fraud – Step‑by‑step procedures for containing SMS pumping attacks and restoring affected systems.

What Undercode Say:

  • Legitimate CAPTCHA pages never ask users to send SMS messages, run commands, or enable browser notifications. Any prompt requiring these actions is a scam, and users should immediately close the page and report the domain.
  • Mobile carriers provide configurable controls to block international premium SMS. Users should proactively contact their providers to disable international SMS sending or enable premium‑rate blocking features as a preventive measure before falling victim.
  • Enterprises must stop relying on simple IP‑based rate limiting and adopt behavioral analytics and device fingerprinting. Modern SMS pumping attacks use residential proxies and generative AI to mimic human behavior, bypassing traditional detection entirely.
  • ClickFix malware campaigns eliminate the need for software exploits by manipulating user trust. The most effective defense is user education combined with strict application whitelisting and PowerShell logging.
  • International Revenue Share Fraud is now the most financially damaging form of messaging fraud. Organizations that rely on SMS for verification must implement geo‑blocking, rate limiting, and real‑time anomaly detection to protect their budgets.

Prediction:

In the coming year, fake CAPTCHA attacks will increasingly integrate generative AI to produce adaptive verification pages that change appearance and behavior based on the victim’s browsing habits. These AI‑driven campaigns will become nearly indistinguishable from legitimate verification flows, forcing a fundamental shift in how trust is established on the web. We will also see a rise in cross‑channel attacks where fake CAPTCHAs are delivered not only through compromised websites but also via malvertising, SMS links, and social media advertisements, making detection exponentially harder for both individuals and enterprise security systems.

▶️ Related Video (72% Match):

🎯Let’s Practice For Free:

IT/Security Reporter URL:

Reported By: Hackermohitkumar Warning – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: