Fake CAPTCHA IRSF Scam and 120 Keitaro Campaigns Drive Global SMS, Crypto Fraud

A telecommunications fraud campaign uses fake CAPTCHA to trick users into sending international SMS messages, generating fraudulent charges and revenue for threat actors.

• •Fake CAPTCHA verification instructs users to send SMS to premium-rate numbers registered in high-termination-fee countries like Azerbaijan and Kazakhstan
• •International Revenue Share Fraud (IRSF) scheme exploits inter-carrier charges and colludes with local telecom providers to profit from termination fees
• •Keitaro TDS abuse: 120+ distinct campaigns detected between October 2025 and January 2026, with 226,000 DNS queries across 13,500 domains
• •Threat actors use Facebook Ads, deepfakes, and fake celebrity endorsements to promote cryptocurrency wallet-drainer schemes targeting tokens like Solana and AURA
• •