Threat Actors Target PerimeterX CAPTCHA to Automate Microsoft Account Creation

A recent post on an underground forum has brought renewed attention to the escalating arms race between cybercriminals and anti-bot security vendors.

The solicitation, offering USD 1,500 for a working bypass of PerimeterX (PX) anti-fraud protections—specifically targeting the “hold CAPTCHA” on Microsoft’s signup.live.com—highlights the growing commoditization and sophistication of CAPTCHA evasion toolkits.

Exploiting Anti-Bot Weaknesses

The forum user’s request is highly technical, seeking updates to outdated GitHub codebases designed for earlier versions of PerimeterX’s protection.

The goal: to automate the creation of Microsoft accounts at scale, bypassing the invisible and interactive “Press & Hold” CAPTCHA challenge deployed during registration.

Key technical requirements include:

• Fingerprint Spoofing: The attacker wants to evade PerimeterX’s advanced browser fingerprinting, which collects data such as browser type, screen resolution, installed plugins, and WebGL rendering details to generate a unique digital signature for each visitor.
• Biometric Validation Evasion: There is a request for methods to circumvent any biometric or behavioral validation, such as mouse movements and timing of interactions, which PerimeterX uses to distinguish humans from bots.
• Browser Emulation: The bypass must closely mimic legitimate browser behavior, handling JavaScript execution, session cookies, and HTTP/2/TLS handshakes to avoid detection.

A typical bypass workflow might leverage headless browsers (e.g., Puppeteer, Selenium) and advanced proxy management to rotate IP addresses and user agents, further masking automated activity.

The attacker also references the need to reverse engineer encrypted payloads and cookies, such as the _pxhd token, which serves as proof of passing the CAPTCHA.

Sample Code Snippet for CAPTCHA Bypass API Integration:

pythonimport requests

url = "https://signup.live.com/"
api_key = ""
params = {
    "url": url,
    "apikey": api_key,
    "js_render": "true",
    "premium_proxy": "true"
}
response = requests.get("https://api.bypass-service.com/v1/", params=params)
print(response.text)

PerimeterX’s Multi-Layered Defenses

PerimeterX (now rebranded as HUMAN) is among the most advanced bot mitigation platforms, employing a combination of:

PerimeterX’s system is designed to adapt in real time, using machine learning to identify anomalies and flag suspicious activity.

The “HUMAN Challenge” is intentionally lightweight for users but sophisticated in its analysis, monitoring subtle cues that indicate bot behavior.

Large-Scale Abuse and Industry-Wide Risks

Successfully bypassing PerimeterX on Microsoft’s signup portal would enable cybercriminals to automate the creation of massive numbers of fraudulent accounts.

These could be weaponized for:

• Spam and Phishing: Fake accounts can be used to distribute spam or launch phishing campaigns, as seen in previous attacks targeting Microsoft users.
• Botnets and Fraud: Automated registrations could support botnet operations, credential stuffing, and other forms of digital fraud.
• Evasion of Detection: By mimicking legitimate users, attackers can evade traditional security controls, making takedown and remediation more difficult.

The case echoes previous incidents, such as the Storm-1152 bot ring, which created over 750 million fraudulent Microsoft accounts before being disrupted by coordinated action from Microsoft and partners.

Commoditization of CAPTCHA Evasion

This underground solicitation underscores a broader trend: CAPTCHA bypass is no longer the domain of elite hackers alone.

Toolkits and APIs—some even open-sourced or commercialized—are making advanced evasion techniques accessible to a wider range of attackers.

The ongoing evolution of anti-bot systems, and the persistent targeting by cybercriminals highlight the need for continuous innovation and adaptation in fraud prevention strategies.

As anti-bot vendors and defenders improve detection with behavioral analytics, fingerprinting, and biometric validation, attackers are quick to adapt, ensuring that the battle for account security remains as fierce as ever.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!