Fake CAPTCHA Scam Abuses Verification Clicks to Send Costly International Texts

Infoblox Threat Intelligence uncovered a long-running IRSF campaign (since at least June 2020) that redirects victims from typosquatted domains through traffic distribution systems to fake CAPTCHA pages which, via JavaScript, open the victim's SMS app with pre-filled premium-rate numbers. The scam leverages back-button hijacking to trap users, may cause dozens of high-cost international texts per session, and has been attributed to an affiliate of a European Click2SMS network operating on AS15699.