New CAPTCHA Trap Uses SMS Pumping To Rack Up Massive Phone Charges

Researchers at Infoblox uncovered a long-running international revenue-share fraud (IRSF) campaign that weaponizes realistic fake CAPTCHA pages to open victims' SMS apps and send dozens of premium-rate texts to high-fee numbers across about 17 countries, netting attackers roughly $30 per victim. The attack is browser-based (no malware), leverages JavaScript to trigger multiple SMS sends and hijack the back button to trap users, and exploits telecom billing/termination fees; recommended protections include monitoring bills for small international SMS charges, disabling premium/international SMS, using mobile security and ad blockers, and reporting suspicious messages.