April 10, 2025 By Pierluigi Paganini
AkiraBot, a CAPTCHA-evading Python framework, has spammed over 80,000 websites with AI-generated messages, targeting small and medium-sized businesses.
SentinelOne’s SentinelLabs researchers warn that AkiraBot, a spam framework, targets websites’ chats and contact forms to promote low-quality SEO services,
AkiraBot has already targeted more than 400,000 websites and successfully spammed at least 80,000 websites since September 2024.
AkiraBot uses LLM-generated content and rotating attacker-controlled domains to bypass spam filters. The spam framework evades CAPTCHA and network detection using proxies, unrelated to the Akira ransomware group.
The name AkiraBot comes after its “Akira” SEO domains, it was spotted targeting websites like Shopify, GoDaddy, and Wix.
“The oldest archive refers to the bot as Shopbot, likely a reference to its targeting of websites using Shopify. As the tool evolved, the targeting expanded to include websites built using GoDaddy and Wix, as well as generic website contact forms, which includes websites built using Squarespace, and likely other technologies.” reads the report published by SentinelOne. “These technologies are primarily used by small- to medium-sized businesses for their ease in enabling website development with integrations for eCommerce, website content management, and business service offerings.”