SweetCAPTCHA users complain of advertising pop-ups

The tool is made by SweetCAPTCHA. It requires users to correctly pick out and match images before they're allowed to do some action on a website. CAPTCHAs are intended to prevent abuse by spammers and automated registrations by web bots.

SweetCAPTCHA was busy Tuesday fielding complaints on Twitter from some who noticed a script that was injecting the pop-up ads. Sucuri, a security company, said the pop-ups promote tech support schemes and bogus dating sites.

Sucuri analyzed SweetCAPTCHA's JavaScript and saw it sometimes loads a script from "clktag.com." The Web page for that domain says it is used for serving advertisements for the RevenueHits Ad Network.

SweetCAPTCHA doesn't mention advertising in its website's FAQ. But the company's terms of use says the tool may include third party content, such as ads, banners and links, wrote Denis Sinegubko, a senior malware researcher with Sucuri.

He followed the chain of redirects to other domains triggered by the advertising script in SweetCAPTCHA on a Windows machine, and ended up seeing a pop-up window asking for permission to install an application called the "Media Player HD." Some antivirus engines flag that program as either a trojan or a potentially unwanted program, he wrote.

Using a Linux computer, he saw pages that advertised either a dating site or a tech support scheme. "So the answer is: Yes, the SweetCAPTCHA script is responsible for unwanted and potentially malicious pop-ups," he wrote.

SweetCAPTCHA officials couldn't be immediately reached for comment. On Twitter, SweetCAPTCHA was telling website owners to let them know the addresses of their sites so the issues could be investigated.

The insertion of third-party scripts into software tools is nothing new and brings revenue to developers, Sinegubko wrote. But when many multiple third parties are allowed to load arbitrary content in the tools, the chances that malicious content may be inserted are greater, he wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk