Threat actors conduct an international revenue share fraud campaign by deploying fake CAPTCHA pages that trick victims into sending premium SMS messages to international phone numbers with high termination fees. The campaign uses traffic distribution systems and social engineering to funnel users through multi-stage fake verifications, each triggering numerous SMS messages. Sophisticated evasion techniques such as back button hijacking, tracking cookies, and affiliate advertising networks are employed to maximize victim count and obscure the fraudulent activity. This campaign has been active since at least June 2020 and affects multiple domains associated with the fraud infrastructure.

Victims incur unexpected charges of approximately $30 due to sending over 60 premium SMS messages to international numbers. Telecommunication carriers also experience financial losses from high termination fees associated with these messages. The fraud undermines user trust and can lead to financial harm for both individuals and service providers.

No official patch or fix is applicable as this is a social engineering campaign rather than a software vulnerability. Mitigation should focus on user education to recognize fake CAPTCHA pages and avoid sending SMS messages prompted by suspicious verifications. Telecommunication providers may consider monitoring and blocking premium SMS messages to suspicious international numbers associated with this campaign. Review and block access to known malicious domains linked to this fraud. Since no vendor advisory or official fix is provided, patch status is not applicable.