The AkiraBot network floods thousands of sites with AI spam that bypasses CAPTCHA.
Tens of thousands of websites received spam messages.
A new spam framework called AkiraBot has been discovered, capable of bypassing CAPTCHA filters and generating spam content using the OpenAI API. This spam campaign has affected over 400,000 websites, of which 80,000 were effectively breached to promote dubious services. Cybersecurity researchers have detailed the operation in a report.
At the core of this initiative is a platform named AkiraBot, which focuses on website chats, comment sections, and contact forms, and should not be confused with a ransomware operation of the same name. This Python-based framework utilizes the OpenAI API to generate spam content relevant to the purpose of the websites it targets. The specific targets are two questionable search engine optimization (SEO) services: Akira and ServicewrapGO.
A particular feature of this spam campaign is its ability to bypass CAPTCHA filters. According to researchers, the bot's creator has dedicated a considerable amount of effort to evade these filters, as well as to avoid network detections through a proxy infrastructure that, while intended for advertisers, has been widely used by cybercriminal actors.
To circumvent CAPTCHA systems, the bot employs fake web browsers that mimic the behavior of a real browser. This is accomplished through a tool called Selenium, which allows the opening and interaction with websites. However, since sites can detect fake browsers by looking for clues like missing fonts or mismatched browser information, the bot injects a special code (inject.js) into the site as it loads. This code modifies the appearance of the fake browser, making it look more human-like. If these tricks are not enough to deceive CAPTCHA, the bot resorts to external services that solve CAPTCHAs, like Capsolver, and also targets chat systems on websites, like Reamaze, to refresh tokens and continue spamming undetected.
It is believed that AkiraBot has been operational since September 2024, affecting platforms like GoDaddy, Wix, and Squarespace. In response to this threat, OpenAI has disabled the API key and other associated resources used by malicious actors. Researchers conclude that the author or authors of the bot have shown a strong commitment to overcoming CAPTCHA technologies, indicating a strong motivation to breach the protections of service providers. Moreover, the use of spam content generated by language models highlights the growing challenges that artificial intelligence presents for defending websites against spam attacks.
