Purple Urchin Bypasses CAPTCHA and Steals Cloud Platform Resources
Summary: Unit 42 researchers detailed Automated Libra, a South African-based freejacking group running the PurpleUrchin cryptomining campaign, which creates fake accounts with falsified or potentially stolen credit cards and leaves unpaid balances on cloud platforms offering limited-time trials. The group created more than 130,000 accounts across VPS and cloud providers, including 100,723 unique Heroku accounts and GitHub accounts at an average rate of three to five per minute by defeating GitHub's spiral-galaxy CAPTCHA with ImageMagick's convert and identify tools. The actors containerized their infrastructure using CI/CD techniques, traced back to activity in August 2019, and operated more than 40 crypto wallets across seven cryptocurrencies, automating trades on platforms such as CRATEX ExchangeMarket, crex24 and Luno.
What you should know: More than 130,000 fake accounts and a $190 unpaid balance found on just one account show that trial-based cloud signup is being industrialized against providers, with the actors automating account creation faster than any manual review can keep pace.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026