AI-Powered Cyberattacks: Greasy Opal Bypasses CAPTCHA, Threatens User Accounts
According to a recent report by experts at Arkose Labs, there has been a noticeable surge in the use of the tool Greasy Opal within cyberspace, which facilitates sophisticated attacks, including large-scale bot assaults. This machine learning-based tool enables cybercriminals to conduct extensive attacks, particularly aimed at circumventing CAPTCHA systems.
An illustrative example of such actions is a recent attack orchestrated by the Vietnam-based group Storm-1152. Utilizing Greasy Opal, the attackers created 750 million fake Microsoft accounts. In response, Microsoft’s cybersecurity division managed to seize control of the domains used by Storm-1152 twice in recent months—first in December 2023 and then again in August this year.
The primary targets of these attacks are the digital accounts of real users. The attackers attempt to breach account security systems and mass-produce fake accounts. Greasy Opal leverages advanced computer vision technologies and complex machine learning algorithms to bypass existing security measures.
A researcher from Arkose Labs remarked that this tool significantly simplifies the execution of complex attacks, lowering the entry barrier for potential cyber criminals.
Companies like Greasy Opal often disguise themselves as legitimate businesses with professional websites and marketing. However, their products can be used for dubious purposes, making them particularly dangerous, Gosschalk notes.
“If every user of Greasy Opal’s malicious software sends 10 attacks a day, when multiplied by the threat actor’s entire customer base, that’s a very large attack surface. Now, consider this: If each attack makes tens of thousands of attempts at account login or account creation that’s a massive potential impact on an enterprise. This scenario is what enterprises around the world are dealing with daily,” an ACTIR threat researcher wrote.
Large-scale bot attacks and the creation of fake accounts pose a growing threat to traditional security measures, especially with the use of tools like Greasy Opal. These attacks are characterized by a constant stream of malicious traffic, presenting unique challenges for defense systems.
Researcher emphasizes that businesses can better protect themselves by implementing AI-based threat mitigation strategies and innovative security mechanisms that evolve alongside the changing landscape of cyber threats.
To successfully counter modern AI-driven bot attacks, businesses need to employ comprehensive defense strategies, including not only content delivery networks and firewalls but also account access management systems capable of distinguishing legitimate digital identities from fake ones.
