CAPTCHAs sit in front of login screens and forms to keep bots and spam away. MITRE ATT&CK T1696.001, Automate CAPTCHA Completion, is the sub-technique where adversaries use bots to solve those challenges and carry on. It is part of Anti-Automation Evasion (T1696), in the Stealth tactic, and applies to SaaS.
How attackers use it
MITRE explains that traditional CAPTCHAs ask a person to read characters and type them in, while reCAPTCHA asks for image selection, a checkbox or an evaluation of mouse movement and device cookies. Adversaries may use scripts or toolkits to solve the puzzle automatically. The page gives an example of a script that uses the ImageMagick toolkit to work through image challenges and then create multiple valid accounts. Once the challenge is solved, the script reaches the protected page and can submit forms.
How to detect it
MITRE notes that a successful CAPTCHA completion does not reveal whether it was solved by a person, automated tooling, an AI solver or a third-party human service. Some providers classify sessions as automated or bot-like, which flags suspicious automation but not the method used to pass the challenge. So watch what happens after the pass: bursts of account creation, repeated form submissions, reused challenge tokens and sessions with robotic timing.
How to reduce the risk
- Keep enforcing automation controls after a CAPTCHA is passed. Treat the challenge token as one input, not lasting trust, and block requests that later behave in automated or abusive ways.
- Do not assume post-challenge activity is human. Keep evaluating bot classification, request rate, session characteristics, token reuse, source reputation and behavior, and rate-limit or block what looks wrong.
Quick check
What should happen to a session after it solves a CAPTCHA?
It should keep being scored. The solve is one signal, and later behavior, rate and token reuse can still mark the session as automated.
