Not every bot solves a CAPTCHA. Some are built so the challenge never fires. MITRE ATT&CK T1696.002, Avoid CAPTCHA, describes adversaries who mimic human behavior to slip past automation tests. It is a sub-technique of Anti-Automation Evasion (T1696), sits in the Stealth tactic and applies to SaaS.
How attackers use it
MITRE says adversaries may build a bot that imitates a person through browser automation. The automated browser can masquerade with a spoofed browser fingerprint (see T1036.012) and shape attributes such as session history, IP reputation and browser API use. The page gives Selenium as an example: injected JavaScript can change browser attributes such as Audio Context and voice engines, graphics rendering, installed fonts and navigator objects.
How to detect it
MITRE states there is no target-side behavioral detection strategy based solely on CAPTCHA telemetry, because a challenge that was never shown leaves nothing to inspect. Look instead at signals from the session itself: fingerprint attributes that do not fit together, unusual request timing, many sessions from one source and behavior that is too uniform.
How to reduce the risk
- Apply bot management and application-layer filtering whether or not a CAPTCHA was triggered. Use behavioral, client, session, rate, reputation, token and automation signals, and block or rate-limit policy violations even when no challenge appeared.
- Layer inline controls that act on observed request and session behavior. Silent challenges, browser or client validation, rate controls and bot-management signals help stop clients that look legitimate from getting unrestricted access.
Quick check
Why is a CAPTCHA alone weak against this technique?
Because the bot may never be shown one. Protection has to run on silent signals such as rate and session behavior, not on the challenge appearing.
