On World Password Day, while everyone is focused on creating stronger passwords, fake CAPTCHAs are being used to bypass passwords entirely.
“On World Password Day, updating an old password is a sensible step. But the bigger challenge is changing how we think about digital safety,” said Philip Weiner, Chief Executive Officer, APAC, bolttech. “Despite years of public awareness campaigns and security guidance from governments, banks and technology companies, poor password practices remain widespread.”
bolttech’s recent survey across 11 Asia‑Pacific markets in partnership with Blackbox Research found that nearly 70% of respondents admitted to reusing passwords across multiple accounts. At the same time, most people believe they are doing a decent job at online safety. Around 85% of respondents rated their practices as “good” or “very good”, but the data tells a different story — half of all respondents reuse passwords, skip updates, click quickly and rely on weak protection.
“The scale of exposure is striking,” said Weiner. “Across Asia Pacific, most people report having encountered some form of online scam or digital threat — whether through text messages, phone calls or malicious links.” 39% of survey respondents have already fallen victim to a scam, hack or cybercrime, with more than two‑thirds of cases resulting in financial loss.
“Authorities across the region have repeatedly warned that scams are now a persistent part of daily digital life,” he said. “If risky user habits are one side of the problem, rapidly evolving criminal capabilities are the other. Fraudsters are increasingly using artificial intelligence to scale and refine their attacks. In bolttech’s research, concern about AI‑enabled scams was nearly universal among respondents, and recent developments suggest those fears are well founded.”
“World Password Day has traditionally focused on urging individuals to do better: choose stronger passwords, avoid suspicious links and remain vigilant. Those steps are still essential. But in light of near‑universal scam exposure, AI‑driven fraud and cyber risks that now span entire households, it is evident that individual vigilance is no longer enough,” warned Weiner.
Advocating a more resilient model of shared responsibility that includes technology platforms and telecommunications providers working to block phishing emails, scam websites and fraudulent messages before they ever reach users, while banks can strengthen authentication requirements and provide rapid support when customers are defrauded — as regulators increasingly expect them to do, and insurers can embed cyber protection into widely used apps and services.
“Governments can continue disrupting scam networks while keeping the public informed about emerging threats through national awareness campaigns,” he added. “Together, these measures reinforce one another, creating a digital environment in which the secure option is also the easiest option. When safety is built in by design, a single mistake — a reused password or an accidental click—does not have to become a financial or emotional crisis.”
“By working across industries, sectors and borders, we can rebuild trust and approach the digital future with greater confidence — one password, and one partnership, at a time,” Weiner concluded.
John Wojcik, Senior Threat Researcher, Infoblox, concurred: “This World Password Day, we must recognize that the most effective defense isn’t just a better password: It’s a proactive foundation that stops the thieves before they can ever reach the door. For businesses and consumers alike, this highlights a shift toward social engineering at scale, where the lines between a security check and a cyber-attack are becoming increasingly blurred. “
The CAPTCHA problem
CAPTCHAs are the familiar puzzles we solve on websites to prove we are not robots. Almost three years ago, I learnt from some cybersecurity experts that generative AI will fundamentally disrupt the effectiveness of CAPTCHA, shifting it from a reliable security barrier to an obsolete, user-unfriendly measure.
In particular, multi-modal LLMs can solve traditional visual, text, and audio challenges faster and more accurately than humans.
Unfortunately, many websites still feature CAPTCHAs today, so they are still a familiar sight for Web users all around the globe. The problem is that, not only are they ineffective against bots now, but they are also being used to trick users into unknowingly executing malicious commands that install infostealers directly onto their devices.
Wojcik explained: “Hackers are no longer trying to take over your online accounts with brute force. They have found a much more efficient way to bypass the guessing game entirely by weaponizing a seemingly harmless tool we encounter every day: the CAPTCHA.”
For many Web users, it has become second nature to click the checkbox that says “Yes, I’m a human” when entering a new site. “However, this trust and familiarity is exactly what cybercriminals are now exploiting, warned Wojcik. “Fake CAPTCHA pages trick users into unknowingly pasting malicious commands that install infostealers directly to their devices.”
By solving a fake CAPTCHA, users are effectively handing their personal data over, rendering passwords — no matter how robust — moot. “Once hackers have your password, the damage they can do is vast: These range from impersonation and fraud to reconnaissance by gaining unauthorized access to sensitive IT systems,” said Wojcik.
He added: “While fake CAPTCHAs look deceivingly real to the human eye, they leave important trails on the Domain Name System (DNS), the often-forgotten part of the internet that is involved in every type of cyber-attack. To guard ourselves against this new threat, we must move away from reactive security and strengthen the foundations. Protective DNS security can proactively identify and block the malicious domains hosting fake CAPTCHAs before they ever reach a user’s screen.”
