Phishing Threat Uses CAPTCHAs to Hack Accounts

October 28, 2020

Hikvision HikWire blog article CAPTCHA Phishing Hacks

Three Tips from Hikvision to Avoid Becoming a Victim of CAPTCHA Phishing Hacks


Cybercriminals are using CAPTCHA phishing to hack accounts, according to the SC Magazine article, “Phishing pages leverage CAPTCHAs to fool users, evade detection.”

CAPTCHAs, also known as reCAPTCHAS, are typically used on legitimate websites as a way to verify that a visitor is a human, not a robot.

“Users have undoubtedly become familiar with CAPTCHAs through the regular use of the web, so a CAPTCHA can preserve the illusion of normality when users click links offered to them in phishing emails,” said principal researcher for KnowBe4, Eric Howes, in the SC Magazine article.

The story offered a few suggestions to identify fraudulent or phishing CAPTCHAs to prevent becoming a victim. These included identifying:

  • CAPTCHAs on a blank website background, which are often suspicious.
  • CAPTCHAs on a website that doesn’t typically use them (i.e. Microsoft login pages).

Hikvision on CAPTCHA Phishing Examples
Hikvision’s senior director of cybersecurity, Chuck Davis, covered this hacking method in a recent blog, “Examples of reCAPTCHAS Hacks and Phishing Threats, Plus 4 Tips to Avoid Becoming a Victim to these Cyberattacks.” It becomes a “bait and switch” where a valid method from legitimate sites is used to trick visitors into disclosing information.

“What this means is that if you are tricked into clicking on a link or opening an attachment from a phishing email, you might be met with a real, reCAPTCHA challenge which has you check a box to prove that you are not a robot. In this context, a ‘robot’ or a ‘bot’ is an automated program that scours the Internet looking to scrape data from sites, create fake accounts or post fake reviews. When you click that box and pass the reCAPTCHA test, you are sent to the malicious phishing page. While clicking that box is an easy test for humans, the automated cybersecurity tools that check the links in our email work much like the malicious bots and are unable to get past that reCAPTCHA to determine if the page has suspicious or malicious content,” said Davis, in the Hikvision article.

Three Tips to Avoid Being a Victim of this CAPTCHA Scam

  1. Follow standard phishing detection recommendations.
  2. Don’t leave your guard down when you see something that looks credible, like a reCAPTCHA.
  3. Use a password manager and have it automatically fill in your username and password. If you’re on a phishing site, it won’t paste your credentials into an unrecognized domain, for example versus

IMPORTANT! This model requires non-standard firmware. Do Not Install standard firmware (e.g. v.4.1.xx) on this model. Doing so will permanently damage your system. You must use custom firmware v.4.1.25 from the iDS-9632NXI-I8/16S product page.

By downloading and using software and other materials available via this website, you agree to be legally bound by HIKVISION General Terms of Use . If you don’t agree to these terms, you may not download or use any of those materials.

If you are agreeing on behalf of your company, you represent and warrant that you have legal authority to bind your company to the General Terms of Use above. Also you represent and warrant that you are of the legal age of majority in the jurisdiction in which you reside (at least 18 years of age in many countries).