Fake CAPTCHA IRSF Scam and 120 Keitaro Campaigns Drive Global SMS, Crypto Fraud

Infoblox researchers describe an active, large‑scale international revenue‑share SMS fraud campaign that leverages malicious traffic distribution systems (notably Keitaro TDS) and fake CAPTCHA flows — including back‑button hijacking and programmatically prefilled SMS triggers — to force victims into sending multiple premium international SMS messages and generate illicit termination fees. The report documents dozens of phone numbers across many countries, multi‑stage verification flows that can send up to dozens of SMS messages per victim, and broader Keitaro abuse spanning over 120 campaigns and hundreds of thousands of DNS queries tied to malware delivery and cryptocurrency wallet‑drainer schemes.