AkiraBot AI spam tool bypasses CAPTCHAs on 80,000 websites
SentinelLabs reported that AkiraBot, an AI-powered spam tool discovered in late 2024, successfully spammed approximately 80,000 websites by bypassing CAPTCHAs and using OpenAI-generated customized messages to promote fraudulent SEO services. The researchers noted the tool's sophisticated CAPTCHA bypass and network evasion techniques, and warned it could be repurposed for phishing, malware distribution or social engineering attacks.
What happened
SentinelLabs discovered AkiraBot, an AI-powered spam tool first observed in late 2024, that targets website contact forms and chat widgets by bypassing CAPTCHA protections. The bot uses OpenAI's language models to generate customized messages for each website it targets, scanning site structure and content to craft contextually relevant spam that is harder to detect than generic messages.
AkiraBot employs sophisticated CAPTCHA bypass mechanisms including visual solvers and automated response systems that adapt to different platform styles, along with network evasion techniques such as rotating proxy services, custom headers and randomized payloads. According to SentinelLabs' report, the bot successfully targeted at least 80,000 of more than 400,000 websites scanned, primarily those operated by small to medium-sized businesses on platforms like Shopify, GoDaddy, Wix and Squarespace.
Reported impact
The bot is currently being used to promote dubious SEO services branded with the words 'Akira' or 'ServiceWrap' and offered at approximately $30 per month. SentinelLabs researchers note that the modular framework could be easily repurposed for more harmful campaigns including phishing attacks, malware distribution, or social engineering campaigns aimed at compromising sensitive data.
Index analysis
AkiraBot demonstrates how AI language models can be misused to generate convincing spam at scale. The tool's use of customized, contextually relevant messages powered by OpenAI's models makes the spam significantly harder for traditional filtering systems to detect compared to generic spam approaches.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.