in brief
- Scammers are exploiting the growing use of CAPTCHAs to trick people into running malicious code outside their browser.
- An expert has practical tips on how to minimise your risk.
CAPTCHAs are meant to protect our online infrastructure from bots. Scammers, however, are turning them against us.
Cybersecurity experts have seen a rise in fake CAPTCHA scams, with the Australian Signals Directorate (ASD) releasing a warning this week about the ruse.
The fake CAPTCHAs direct internet users to input code outside of their browser, which grants hackers access to the device and, in some cases, browser session information.
The scams often ask them to paste a script into a computer's terminal, allowing the attacks to bypass anti-malware security systems.
Hammond Pearce, senior lecturer at UNSW School of Computer Science and managing director of the Digital Lies & Cyber Literacy Foundation, said the ability to bypass anti-malware protections made fake CAPTCHA scams particularly dangerous.
News that makes sense
Your trusted source for staying up-to-date with the world around you. Get free daily news updates and analysis, straight to your inbox.
"You haven't got very many of the protections of the operating system working for you," he told SBS News.
Previously, CAPTCHAs were commonly required for creating online account. However, they're now common when making the first connection with a website, greatly increasing the number that internet users are asked to complete.
Pearce attributes this to "the explosion of AI agents online" as websites attempt to prevent artificial intelligence from going through them.
The increased prevalence of CAPTCHAs means it's easier for dodgy ones to slip through.
Pearce said he'd "expect it more on slightly dodgier websites" but hackers "can try and hijack your connection so that you get that when you're trying to get to a normal website".
Pearce also said the number of fake CAPTCHA attacks "are now measured in the millions".
How to avoid fake CAPTCHAs
According to Pearce, it's now much harder than it used to be for criminals to leverage a person's internet connection against them.
Major browsers such as Chrome, Firefox and Edge have used significant resources to make themselves "about the safest piece of technology there is on your computer", Pearce said.
He said users should be suspicious if a CAPTCHA asks them to type something or leave the window.
"If it's actually asking you to type some random thing on your keyboard, you should immediately start getting suspicious," Pearce said.
"Be very wary of anything that might take you out of the safety of the web browser."
He says that, if something feels off, internet users should ask themselves: "Why? Why do I need to do this?"
For the latest from SBS News, download our app and subscribe to our newsletter.
