InfoSecBulletin Cybersecurity for mankind
Cybersecurity researchers are warning that CAPTCHA-breaking services are being offered for sale to bypass systems designed to distinguish legitimate users from bot traffic.
These services work by farming out CAPTCHA-breaking tasks to actual human solvers. This makes it easy for customers of CAPTCHA-breaking services to develop automated tools against online web services. And because actual humans are solving CAPTCHAs, the purpose of filtering out automated bot traffic through these tests are rendered ineffective.
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA
CVE-2025-29824
Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day
Hacker exploited Samsung MagicINFO 9 Server RCE flaw
CISA adds Langflow flaw to its KEV catalog
Google Fixes Android Flaw (CVE-2025-27363) Exploited by Attackers
UAP hosted “UAP Cyber Siege 2025”, A national level cybersecurity competition
Threat actors have also been observed purchasing CAPTCHA-breaking services and combining them with proxyware offerings to obscure the originating IP address and evade antibot barriers.
ALSO READ:
World see transmission at a record speed of 200 gigabits per second
Proxyware, although marketed as a utility to share a user’s unused internet bandwidth with other parties in return for a “passive income,” essentially turns the devices running them into residential proxies.
In one instance of a CAPTCHA-breaking service targeting popular social commerce marketplace Poshmark, the task requests emanating from a bot are routed via a proxyware network.
“CAPTCHAs are common tools used to prevent spam and bot abuse, but the increasing use of CAPTCHA-breaking services has made CAPTCHAs less effective,” said security researcher Joey Costoya. “While online web services can block abusers’ originating IPs, the rise of proxyware adoption renders this method as toothless as CAPTCHAs.”
To mitigate such risks, online web services are recommended to supplement CAPTCHAs and IP blocklisting with other anti-abuse tools.
Here are some additional tips for mitigating the risks posed by CAPTCHA-breaking services:
- Use a variety of anti-abuse tools, including CAPTCHAs, IP blocklisting, and anomaly detection.
- Monitor your traffic for signs of abuse, such as unusual spikes in traffic or requests from unusual IP addresses.
- Keep your software up to date with the latest security patches.
- Train your staff to be aware of the signs of abuse and how to report it.
