New AkiraBot Abuses OpenAI API, Spammed 400K Sites with Fake SEO

Cybersecurity researchers have identified a new spam campaign driven by ‘AkiraBot,’ an AI-powered bot that targets small business websites with customized promotional messages.

AkiraBot, a new sophisticated spamming tool, has managed to spam contact forms and chat widgets on at least 80,000 websites, with over 400,000 targeted since September 2024.

SentinelLabs, a research team at SentinelOne, spotted this advanced framework leveraging AI language models like OpenAI’s GPT-4o-mini to create unique spam content, bypassing CAPTCHA protections and targeting popular website platforms.

AkiraBot starts its attack by analysing a website’s content to generate personalized messages promoting a fraudulent SEO service, making it harder for standard spam filters to detect and block. The campaign primarily focuses on small and medium-sized businesses (SMBs) using popular website builder platforms such as Shopify, GoDaddy, Wix, and Squarespace.

These platforms are often chosen by SMBs for their ease of use, making them attractive targets for spammers looking to reach a large number of businesses efficiently.

According to SentinelLabs’ report shared with Hackread.com ahead of its publishing on Wednesday, AkiraBot is capable of multiple malicious activities, including:

Creating AI-Generated Messages: By using OpenAI’s language models, AkiraBot creates messages that appear customized to the specific website it targets. This customization involves using AI to replace variables like the website name and relevant keywords, making each message unique.

CAPTCHA Bypass: One of the standout features of AkiraBot is its sophisticated techniques to bypass CAPTCHA protections. It uses tools like FastCaptcha and NextCaptcha and even manipulates browser attributes to mimic legitimate user behavior, thus tricking CAPTCHA systems.

Targeting Small Businesses: AkiraBot specifically focuses on small to medium-sized businesses (SMBs) that use popular website builders. This focus, according to researchers, is strategic, as these platforms often have a high number of small businesses with basic security measures.

Proxy Networks: To avoid detection based on IP address or location, AkiraBot uses proxy services, specifically SmartProxy, to route its traffic through various IP addresses. This helps the bot distribute its spamming activity and avoid being blocked by network-based protection.

“There are many versions of this tool with file timestamps in the archives indicating activity between September 2024 to present. Each version uses one of two hardcoded OpenAI API keys and the same proxy credentials and test sites, which links the archives despite the disparate naming conventions.”

SentinelLabs

The rise of AkiraBot could be a major cybersecurity threat to small businesses. By spamming contact forms and live chat widgets with offers for scam SEO services, the bot not only wastes valuable time for business owners but can also damage their online reputation. The targeted nature of these spam messages makes them appear more legitimate, increasing the likelihood that recipients might engage with the fraudulent offers.

The spam messages consistently promote SEO services under the brand names “Akira” and “ServiceWrap.” While the domains used for these services rotate, SentinelLabs found connections through historical DNS data, including links to infrastructure previously associated with malicious activities.

The researchers also observed fake positive reviews for these SEO services on platforms like TrustPilot, suggesting an effort to build legitimacy despite the spamming operation. Fake reviews are a major problem across industries, from malicious apps on official app stores to products on Amazon. They mislead unsuspecting users into trusting questionable services and make it easier for scams to succeed

SentinelLabs traced the tool’s development back to September 2024, noting several versions and code names (including “Shopbot,” “GoDaddy,” and “Wixbot”), indicating continuous improvement of its targeting capabilities. While initially focused on contact forms, newer versions also target live chat widgets, including those provided by services like Reamaze.

The researchers also identified a connection between the bot’s operators and a Telegram user associated with logging success metrics. The bot tracks its progress, logging successful spam submissions (over 80,000 as of January 2025) and failed attempts.

For small businesses that depend on their websites to connect with customers, this kind of spam can be a real headache. It clogs up communication channels and makes it harder to spot real messages. It can also harm customer trust in the business.

Although blocking spam domains can help, since the Akirabot keeps adapting, businesses have to stay alert. It’s not just big companies, small businesses also need protection from cyberattacks.