{“lastseen”:”2026-04-28T12:50:20″,”description”:”Researchers have documented a long\u2011running campaign that uses fake CAPTCHA pages to trick mobile users into sending dozens of international SMS messages in the background.\\n\\nIf you\u2019ve spent any time on today\u2019s web, CAPTCHAs may seem like background noise: click a few traffic lights, prove you\u2019re human, move on. Something scammers have learned to abuse in ClickFix campaigns where they lure victims into infecting their own machines.\\n\\nRecently, though, researchers found a twist where \u201cprove you\u2019re human\u201d quietly turns into \u201crun up an international phone bill.\u201d The research describes an International Revenue Share Fraud (IRSF) campaign. IRSF, also known as SMS pumping fraud, abuses the complex pricing structures of international calls and SMS traffic to generate revenue by inflating message volume to particular destinations.\\n\\nInstead of installing malware on the victim\u2019s device, the scam exploits how telecom billing and affiliate networks work, turning ordinary web traffic into premium SMS revenue for cybercriminals.\\n\\n## How it works\\n\\nA typical flow for the scam looks like this:\\n\\n * Victims arrive via malvertising or TDS redirects, often from typosquatted telecom domains, onto a page that looks like a basic image\u2011selection or quiz CAPTCHA.\\n * To \u201ccontinue,\u201d they’re prompted to tap a button that opens their SMS app with a prefilled message and recipient list.\\n * This isn\u2019t one SMS to one number. The fake CAPTCHA runs through multiple steps, and each message is preconfigured with more than a dozen international numbers across 17 countries known for high termination fees, including Azerbaijan, Myanmar, and Egypt.\\n\\n\\n\\nOn a typical consumer plan, that can translate to roughly $30 in international SMS charges per person, with a slice of the termination fees flowing back to the attacker via revenue\u2011sharing agreements.\\n\\nTo keep you from simply backing out, the pages deploy dedicated back\u2011button hijacking. JavaScript rewrites browser history and bounces you back to the scam when you try to leave. The researchers also found the campaign was plugged into a Click2SMS\u2011style affiliate network that advertises \u201call kinds of traffic allowed\u201d and carrier billing, effectively packaging IRSF as another monetization option for shady publishers.\\n\\nThis operation defrauds both individuals and telecom carriers. Victims face unexpected premium SMS charges on their bills and may struggle to trace the cause. Carriers pay revenue shares to the perpetrators and may absorb losses from customer disputes or chargebacks.\\n\\n* * *\\n\\n\\n\\n### Mobile **protection, anywhere, anytime.**\\n\\nTRY IT NOW\\n\\n* * *\\n\\n## How to protect yourself\\n\\nNever send an SMS to \u201cprove you\u2019re human.\u201d Legitimate CAPTCHAs run entirely in your browser. They won’t open your SMS or dialer app.\\n\\nCheck your mobile bill regularly for small, unfamiliar international SMS charges, not just big spikes. If you see anything suspicious, dispute it quickly and ask your provider to block international or premium SMS if you don\u2019t need it.\\n\\nUse a mobile protection app that blocks known malicious sites, like these domains involved in this campaign:\\n\\n * `sweeffg[.]online`\\n * `colnsdital[.]com`\\n * `zawsterris[.]com`\\n * `megaplaylive[.]com`\\n * `ruelomamuy[.]com`\\n\\n![Malwarebytes blocks ruelomamuy\\\\[.\\\\]com](https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2026\/04\/ruelomamuycomblock.png)Malwarebytes blocks ruelomamuy[.]com\\n\\n* * *\\n\\n**Scammers know more about you than you think.** \\n\\nMalwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. \\n\\nDownload for iOS \u2192 Download for Android \u2192”,”published”:”2026-04-28T10:46:01″,”modified”:”2026-04-28T10:46:01″,”type”:”malwarebytes”,”title”:”Fake CAPTCHA scam turns a quick click into a costly phone bill”,”source”:””,”references”:””,”id”:”MALWAREBYTES:D708A429410192DBD16DAAEC7E22285E”,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.malwarebytes.com\/blog\/news\/2026\/04\/fake-captcha-scam-turns-a-quick-click-into-a-costly-phone-bill”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-28T12:50:20″,”description”:”Researchers have documented a long\u2011running campaign that uses fake CAPTCHA pages to trick mobile users into sending dozens of international SMS messages in the background.\\n\\nIf…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,115,13,33,7,11,5],"class_list":["post-49919","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-malwarebytes","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n