Cybercrime as a Service Fuels New Scam Waves

How the attack worked

A threat landscape report describes how cybercrime capabilities are increasingly sold or rented as services, allowing even low-skilled actors to operate at scale with anonymity and short-lived infrastructure. Two repeatable web-based scams stand out. The first uses a fake CAPTCHA or human-verification page that tricks mobile users into taking an action that triggers costly international text messages, with one observed case generating about 60 messages and roughly $30 in charges. The second uses a similar fake verification, cookie banner, or CAPTCHA prompt to get users to click Allow on browser notifications. Once granted, that permission becomes a persistent channel attackers use to flood victims with scam notifications, in some cases more than 140 per day promoting investment scams, gambling sites, fake antivirus alerts, and government impersonation content.

Why it succeeded

These scams work because they exploit routine, low-friction interactions that people rarely question: clicking through a CAPTCHA or approving a notification permission. Attackers also build lookalike lure pages that replicate branding, logos, and user experience closely enough that victims trust them without checking the underlying domain. AI is also being used to automate reconnaissance and generate more convincing lures, while cloaking, redirect chains, and fast domain rotation, with some phishing pages lasting under 24 hours, make detection and takedown harder.

What to watch for

• A CAPTCHA or verification step that unexpectedly triggers messaging activity or unusual charges
• A site demanding notification permissions as a condition for viewing content
• A sudden flood of notifications after granting Allow
• Lookalike login or verification pages reached through unexpected links
• Requests for OTPs, device fingerprints, or biometric data through a verification flow

How to build resistance

• Treat unexpected CAPTCHA or verification prompts as suspicious, especially if they trigger messaging or app-level actions
• Avoid clicking Allow on notification prompts unless there is a clear, expected business reason
• Train staff to verify link sources and domains rather than trusting logos or page design alone
• Give extra attention to executives, finance, and customer support roles, since these groups face targeted impersonation, BEC attempts, and OTP or credential harvesting
• Reinforce that legitimate verification steps rarely require sending messages, granting broad permissions, or entering one-time passwords on unfamiliar pages

What is cybercrime as a service?

It refers to criminals buying or renting phishing, fraud, malware, and hidden infrastructure as ready-made services, which lets even low-skilled actors run scams at scale with anonymity and short-lived infrastructure.

How do fake CAPTCHA scams work?

A fraudulent human-verification page tricks a mobile user into an action that triggers expensive international text messages, with one observed case generating about 60 messages costing about $30.

Why are browser push-notification prompts risky?

Clicking Allow on a fake CAPTCHA, cookie banner, or verification prompt gives attackers a persistent channel to the device, and some victims received more than 140 scam notifications per day.

Are executives specifically at risk?

Yes, executives are exploited in impersonation fraud, business email compromise, and other social engineering schemes because of their identities and access.