Cybersecurity researchers have revealed details about an artificial intelligence (AI)-based platform called AkiraBot, which is used to send spam messages in website chats, comment sections, and contact forms in order to promote dubious search engine optimization (SEO) services such as Akira and ServicewrapGO.
See also: Vo1d malware botnet targets more and more Android TVs
The targets of this activity include contact forms and chat tools found on small and medium-sized business websites, with the system distributing spam content generated using OpenAI’s large language models (LLMs). What sets the “extensive” Python-based tool apart is its ability to generate content that can bypass spam filters.
The mass messaging tool is believed to have been in operation since at least September 2024, starting with the name “Shopbot,” in an apparent reference to websites that use the Shopify.
Over time, AkiraBot has expanded its targeting reach to include websites developed using GoDaddy, Wix , and Squarespace, as well as those with generic contact forms and live chat widgets built with Reamaze.
The core functionality of the process – generating spam content – is supported by leveraging the OpenAI API. The tool also provides a graphical user interface (GUI) for selecting the list of websites to target and adjusting the number of them that can be targeted at once.
An analysis of the source code reveals that the OpenAI client uses the gpt-4o-mini model and has been assigned the role of a “helpful assistant that creates advertising messages.”
See also: Golang-based backdoor uses Telegram Bot API for C2 purposes
Another notable feature of the service is its ability to bypass CAPTCHA barriers to spam websites on a large scale, avoiding network-based detections, by using a proxy typically offered to advertisers. Targeted CAPTCHA services include hCAPTCHA, reCAPTCHA , and Cloudflare Turnstile.
To achieve this, the bot's web traffic is designed to mimic a legitimate end user and uses various proxy servers from SmartProxy to hide the origin of the traffic.
AkiraBot is also configured to log its activities in a file named “ submissions.csv ”, which records both successful and failed spam attempts. An examination of these files has revealed that more than 420,000 unique domains have been targeted to date. In addition, success metrics related to CAPTCHA bypassing and proxy rotation are collected and published to a Telegram channel via API
In response to the findings, OpenAI has disabled the API key and other related assets used by the perpetrators.
See also: SnowDog: New RAT malware advertised on hacking forums
Spam large quantities via email or other communication platforms. The term is mainly used to describe messages sent to recipients without their consent and often intended to promote products or services. To protect someone from spam, spam filters are usually used that detect and block these messages before they reach the user.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Source: thehackernews
