Fake CAPTCHA, Real Business: Traffic Distribution for Hire

A sophisticated traffic distribution system has been operating for over 14 months, using more than 12,700 structurally similar fake CAPTCHA PDFs hosted on Webflow's CDN. The operation begins with search engine optimization, where victims searching for legitimate content encounter malicious PDFs through Google searches. These documents contain fake CAPTCHA panels that route users through a custom Elixir/Phoenix traffic distribution system employing IP filtering, bot detection, and geographic targeting. The infrastructure sorts visitors and redirects qualifying traffic to three distinct endpoints: Legion Loader distribution, a TDS reseller gate, and premium-SMS subscription scams targeting Spanish-speaking users. Non-qualifying traffic is monetized through search-arbitrage advertising. The operation primarily targets English-speaking countries and has recently been surfaced by AI assistants including Google Gemini and Claude, expanding its reach beyond traditional search engines.

• Black Hat SEO Poisoning Search Engine Results For AI to Distribute MalwareMalware2025-06-26
• BengalSEO Part 1: Anatomy of the OperationMalware2026-09-06
• From open lures to cloaked gates: How a macOS ClickFix campaign learned to hideMalware2026-08-05
• Operation Endgame vs. SocGholish Fake UpdatesMalware2026-06-18
• Sayonara, SocGholish: Operation Endgame Disrupts Major Cybercrime OperationMalware2026-06-18