Anti-Detection Browser Evasion — CAPTCHA-Solving API Contacted (aihawk-style)
This detects a process on your network reaching out to a known CAPTCHA-solving or anti-detection service, such as 2captcha, anti-captcha, capsolver, or similar. These services let automated software beat CAPTCHA challenges and hide the fact that traffic is machine-generated, which is a hallmark of bots used for things like mass job applications, credential stuffing, or scraping.
How the attack works
An automation toolkit (the kind of behavior publicly marketed by tools like 'aihawk') runs a browser automation session designed to interact with websites as if it were a human. When it hits a CAPTCHA challenge, it forwards the challenge to a third-party solving API instead of a person solving it. The rule spots the outbound web request to one of these known solver-vendor domains, ties it to the specific process instance that made it, and traces that instance's parent processes to show what launched it. It can also check whether that same process made an earlier outbound web request shortly before, to build a short timeline of what happened.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- d3f1b8ec-9a2e-4b7c-8f61-2e4d6a9c1b3d
- Severity
- Medium
Why it matters
An organization running this may be facing automated abuse that evades its bot defenses — for example bulk fake account creation, credential-stuffing attempts, or unauthorized scraping — because CAPTCHA no longer works as a meaningful barrier for that traffic.
What you can do
- →Review the flagged process and its parent chain to confirm whether it belongs to an approved automation, accessibility tool, or QA test suite rather than unauthorized bot activity.
- →If unexpected, check what site or service the process was targeting and what actions it took after the CAPTCHA was solved (account creation, form submission, login attempts).
- →Maintain an allowlist of sanctioned automation and QA tools that are permitted to use CAPTCHA-solving APIs, and treat all other hits as investigation-worthy.
- →Since this only flags one HTTP request to a solver domain, correlate it with other signals (login attempts, account creation rates, scraping volume) rather than treating it as proof of malicious intent on its own.
Known benign look-alikes
- Accessibility services that route CAPTCHA challenges through a solver API on behalf of visually impaired users
- QA / end-to-end test automation suites that intentionally integrate a commercial CAPTCHA-solving API in staging environments to unblock automated test runs
- Authorized penetration-testing or bug-bounty tooling contracted to bypass a target's own CAPTCHA during a scoped engagement
- Internal test farms or synthetic-monitoring bots with a legitimate paid CAPTCHA-solving subscription for non-production form testing