{"id":56644,"date":"2024-07-24T06:33:11","date_gmt":"2024-07-24T06:33:11","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\/"},"modified":"2024-07-24T06:33:11","modified_gmt":"2024-07-24T06:33:11","slug":"forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\/","title":{"rendered":"Forget security \u2013 Google&#8217;s reCAPTCHA v2 is exploiting users for profit"},"content":{"rendered":"<p>Google promotes its reCAPTCHA service as a security mechanism for websites, but researchers affiliated with the University of California, Irvine, argue it&#8217;s harvesting information while extracting human labor worth billions.<\/p>\n<p>The term CAPTCHA stands for &#8220;Completely Automated Public Turing test to tell Computers and Humans Apart,&#8221; and, as Google <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/support.google.com\/a\/answer\/1217728?hl=en\">explains<\/a>, it refers to a challenge-response authentication scheme that presents people with a puzzle or question that a computer cannot solve.<\/p>\n<p>Such tests have been used for nearly two decades to combat fraud and other forms of online automated abuse. CAPTCHA puzzles \u2013 which may involve text, image, audio, or behavioral challenges such as clicking checkboxes \u2013 are ubiquitous online.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"condor\" data-xsm=\",fluid,mpu,\" data-sm=\",fluid,mpu,\" data-md=\",fluid,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>Google acquired the <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/www.google.com\/recaptcha\/\">reCAPTCHA<\/a> service <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/web.archive.org\/web\/20120511113750\/http:\/\/googleblog.blogspot.com\/2009\/09\/teaching-computers-to-read-google.html#!https:\/\/web.archive.org\/web\/20230418194019\/http:\/\/googleblog.blogspot.com\/2009\/09\/teaching-computers-to-read-google.html\">in 2009<\/a>, two years after its debut.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xmd=\",fluid,mpu,leaderboard,\" data-lg=\",fluid,mpu,leaderboard,\" data-xlg=\",fluid,billboard,superleaderboard,mpu,leaderboard,\" data-xxlg=\",fluid,billboard,superleaderboard,brandwidth,brandimpact,leaderboard,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<div class=\"adun_eagle_desktop_story_wrapper\">\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"mid\" data-raptor=\"eagle\" data-xxlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<\/p><\/div>\n<p>The search giant has since revised the service since\u2013 reCAPTCHA v2 arrived in 2014 and reCAPTCHA v3 in 2018, shortly after the shutdown of v1. Though v3 is the latest version, v2 is still used by <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/trends.builtwith.com\/widgets\/reCAPTCHA-v2\">almost three million<\/a> websites.<\/p>\n<p>The utility of reCAPTCHA challenges appears to be significantly diminished in an era when AI models can answer CAPTCHA questions <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2023\/08\/15\/so_much_for_captcha_then\/\" rel=\"noopener\">almost<\/a> as well as humans.<\/p>\n<h3 class=\"crosshead\">Show me the money<\/h3>\n<p>UC Irvine academics contend CAPTCHAs should be binned.<\/p>\n<p>In <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/arxiv.org\/pdf\/2311.10911\">a paper<\/a> [PDF] titled &#8220;Dazed &amp; Confused: A Large-Scale Real-World User Study of reCAPTCHAv2,&#8221; authors Andrew Searles, Renascence Tarafder Prapty, and Gene Tsudik argue that the service should be abandoned because it&#8217;s disliked by users, costly in terms of time and datacenter resources, and vulnerable to bots \u2013 contrary to its intended purpose.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xsm=\",fluid,mpu,\" data-sm=\",fluid,mpu,\" data-md=\",fluid,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>&#8220;I believe reCAPTCHA&#8217;s true purpose is to harvest user information and labor from websites,&#8221; asserted Andrew Searles, who just completed his PhD and was the paper&#8217;s lead author, in an email to <em>The Register<\/em>.<\/p>\n<p>&#8220;If you believe that reCAPTCHA is securing your website, you have been deceived. Additionally, this false sense of security has come with an immense cost of human time and privacy.&#8221;<\/p>\n<p>The paper, released in November 2023, notes that even back in 2016 researchers were able to defeat reCAPTCHA v2 image challenges <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/ieeexplore.ieee.org\/document\/7467367\">70 percent of the time<\/a>. The reCAPTCHA v2 checkbox challenge is even more vulnerable \u2013 the researchers claim it can be defeated 100 percent of the time.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" id=\"story_eagle_xsm_sm_md_xmd_lg_xlg\" data-pos=\"mid\" data-raptor=\"eagle\" data-xsm=\",mpu,dmpu,\" data-sm=\",mpu,dmpu,\" data-md=\",mpu,dmpu,\" data-xmd=\",mpu,dmpu,\" data-lg=\",mpu,dmpu,\" data-xlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>reCAPTCHA v3 has fared no better. In 2019, researchers <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/arxiv.org\/abs\/1903.01003\">devised a reinforcement learning attack<\/a> that breaks reCAPTCHAv3&#8217;s behavior-based challenges 97 percent of the time.<\/p>\n<p>&#8220;Version 3 is better than v2 since it is purely behavioral,&#8221; noted Gene Tsudik, professor of computer science at the University of California, Irvine. &#8220;But, like v2, is not a true CAPTCHA \u2013 meaning it&#8217;s not &#8216;public&#8217; and it&#8217;s not a Turing Test. It is a behavioral analytics-based method that assigns scores to user behavior. Thus it&#8217;s privacy-invasive, since we (the public) don&#8217;t know how it works. It&#8217;s essentially a &#8216;black box.&#8217;<\/p>\n<p>&#8220;These systems were beaten before they were ever introduced on the global scale,&#8221; argued Searles. &#8220;Image selection problems were solved by computers in 2009 (yet added by Google in 2014). reCATPCHA third-party cookies for behavioral detection introduced <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/homakov.blogspot.com\/2014\/12\/the-no-captcha-problem.html\">the &#8216;click-jacking&#8217; vulnerability<\/a>, making it easier to automatically bypass them.&#8221;<\/p>\n<h3 class=\"crosshead\">You are the product<\/h3>\n<p>The authors&#8217; research findings are based on a study of users conducted over 13 months in 2022 and 2023. Some 9,141 reCAPTCHAv2 sessions were captured from unwitting participants and analyzed, in conjunction with a survey completed by 108 individuals.<\/p>\n<p>Respondents gave the reCAPTCHA v2 checkbox puzzle 78.51 out of 100 on the <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/en.wikipedia.org\/w\/index.php?title=System_usability_scale&amp;oldid=1235837934\">System Usability Scale<\/a>, while the image puzzle rated only 58.90. &#8220;Results demonstrate that 40 percent of participants found the image version to be annoying (or very annoying), while &lt;10 percent found the checkbox version annoying,&#8221; the paper explains.<\/p>\n<p>But when examined in aggregate, reCAPTCHA interactions impose a significant cost \u2013 some of which Google captures.<\/p>\n<p>&#8220;In terms of cost, we estimate that \u2013 during over 13 years of its deployment \u2013 819 million hours of human time has been spent on reCAPTCHA, which corresponds to at least $6.1 billion USD in wages,&#8221; the authors state in their paper.<\/p>\n<p>&#8220;Traffic resulting from reCAPTCHA consumed 134 petabytes of bandwidth, which translates into about 7.5 million kWhs of energy, corresponding to 7.5 million pounds of CO<sup>2<\/sup>. In addition, Google has potentially profited $888 billion from cookies [created by reCAPTCHA sessions] and $8.75\u201332.3 billion per each sale of their total labeled data set.&#8221;<\/p>\n<p>Asked whether the costs Google shifts to reCAPTCHA users in the form of time and effort are unreasonable or exploitive, Searles pointed to the <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/www.researchgate.net\/publication\/237777920_How_Lazy_Cryptographers_do_AI\">original white paper<\/a> on CAPTCHAs by Luis von Ahn, Manuel Blum, and John Langford \u2013 which includes a section titled &#8220;Stealing cycles from humans.&#8221;<\/p>\n<p>&#8220;This basically [summarizes] how CAPTCHAs create an exploitative economy of function where nefarious bots can conscript humans to complete challenges for them,&#8221; Searles explained. &#8220;It is unreasonable to make someone solve a security challenge when there is no gained security.&#8221;<\/p>\n<p>That cost should be borne by Google rather than website users, Searles argued. &#8220;If a service claims to detect bots then it should detect bots \u2013 especially if it&#8217;s a paid service.&#8221;<\/p>\n<p>As the paper points out, image-labeling challenges have been around since 2004 and by 2010 there were attacks that could beat them 100 percent of the time. Despite this, Google introduced reCAPTCHA v2 with a fall-back image recognition security challenge that had been proven to be insecure four years earlier.<\/p>\n<p>This makes no sense, the authors argue, from a security perspective. But it does make sense if the goal is obtaining image labeling data \u2013 the results of users identifying CAPTCHA images \u2013 which Google <a target=\"_blank\" rel=\"nofollow noopener\" href=\"https:\/\/cloud.google.com\/ai-platform\/data-labeling\/pricing\">happens to sell<\/a> as a cloud service.<\/p>\n<p>&#8220;The conclusion can be extended that the true purpose of reCAPTCHA v2 is a free image-labeling labor and tracking cookie farm for advertising and data profit masquerading as a security service,&#8221; the paper declares.<\/p>\n<p>&#8220;I think that there is absolutely NO space for hard AI problems to exist in computer security,&#8221; suggested Searles. &#8220;This has been an experiment that has enhanced some computational ability but there is no realistic or measurable security achieved from using such technology.&#8221;<\/p>\n<p>Google did not respond to a request for comment. \u00ae<\/p>\n<p> READ MORE <a href=\"https:\/\/go.theregister.com\/feed\/www.theregister.com\/2024\/07\/24\/googles_recaptchav2_labor\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Web puzzles don&#8217;t protect against bots, but humans have spent 819 million unpaid hours solving them Google promotes its reCAPTCHA service as a security mechanism for websites, but researchers affiliated with the University of California, Irvine, argue it&#8217;s harvesting information while extracting human labor worth billions.\u2026 READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[],"class_list":["post-56644","post","type-post","status-publish","format-standard","hentry","category-the-register"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Forget security \u2013 Google&#039;s reCAPTCHA v2 is exploiting users for profit 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Forget security \u2013 Google&#039;s reCAPTCHA v2 is exploiting users for profit 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2024-07-24T06:33:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Forget security \u2013 Google&#8217;s reCAPTCHA v2 is exploiting users for profit\",\"datePublished\":\"2024-07-24T06:33:11+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\\\/\"},\"wordCount\":991,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\\\/\",\"name\":\"Forget security \u2013 Google's reCAPTCHA v2 is exploiting users for profit 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"datePublished\":\"2024-07-24T06:33:11+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\\\/#primaryimage\",\"url\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"contentUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Forget security \u2013 Google&#8217;s reCAPTCHA v2 is exploiting users for profit\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Forget security \u2013 Google's reCAPTCHA v2 is exploiting users for profit 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\/","og_locale":"en_US","og_type":"article","og_title":"Forget security \u2013 Google's reCAPTCHA v2 is exploiting users for profit 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2024-07-24T06:33:11+00:00","og_image":[{"url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Forget security \u2013 Google&#8217;s reCAPTCHA v2 is exploiting users for profit","datePublished":"2024-07-24T06:33:11+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\/"},"wordCount":991,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\/","url":"https:\/\/www.threatshub.org\/blog\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\/","name":"Forget security \u2013 Google's reCAPTCHA v2 is exploiting users for profit 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","datePublished":"2024-07-24T06:33:11+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\/#primaryimage","url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","contentUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/front&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2ZqCnC6d9bILqJGoKeMWM8gAAAEY&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/forget-security-googles-recaptcha-v2-is-exploiting-users-for-profit\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Forget security \u2013 Google&#8217;s reCAPTCHA v2 is exploiting users for profit"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/56644","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=56644"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/56644\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=56644"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=56644"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=56644"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}