New Fake CAPTCHA Campaign Uses SMS Pumping Fraud to Run Up Victims’ Phone Bills

A widespread scam leverages fake CAPTCHA pages and redirects from malvertising/TDS to open victims' native SMS apps with prefilled messages sent to dozens of international premium numbers (across ~17 countries), creating termination fees that are shared with criminals; no malware is installed, victims may incur roughly $30 per interaction, and the report includes attack TTPs, mitigation steps, and associated malicious domains.