Is it possible to bypass hotmail's click and hold captcha?

[Deleted member 1172552]

Is it possible to bypass hotmail's click and hold captcha? 2captcha and capsolver says they're not able to bypass it.

 

[omfg_wtf]

Have you tried automation tools like Puppeteer or Selenium?

 

[kingkong2222]

it has two type of captcha one is invisible & it will start recording your movement and everything at the moment you start reg. and once you are at the end of it then second type of captcha appear i.e. Press & hold.

You can only get though 1 or two time with your .py or .js script but it will detect your movement soon, for this task you need to train a Custom AI model.

 

[DeathGrips]

I do this with over 2k microsoft emails for over 6 months. hotmail + outlook. not a single one died. accesing all using OAuth2 via the SASL XOAUTH2 mechanism

some code:

Pseudocode for reading email:​

function readEmails(emailAccount, count=10):

    # 1. ENSURE PROXY IS ALIVE (retries forever)
    proxy = getDefaultProxy()
    getProxyIp(proxy)  // confirm proxy responds, never timeout

    # 2. GET A FRESH ACCESS TOKEN
    #    POST to https://login.microsoftonline.com/common/oauth2/v2.0/token
    #    with: client_id, refresh_token, grant_type="refresh_token"
    #    → returns short-lived access_token (good for ~1 hour)
    #    request goes through proxy via HTTP CONNECT tunnel
    tokenResult = refreshToken(emailAccount, proxy)
    accessToken = tokenResult.accessToken

    # 3. CONNECT TO POP3 SERVER
    #    Two paths depending on proxy:
    #
    #    WITH PROXY:
    #      a. TCP connect to proxy host:port
    #      b. Send "CONNECT outlook.office365.com:995 HTTP/1.1"
    #         with Proxy-Authorization: Basic base64(user:pass)
    #      c. Wait for "HTTP/1.1 200" response
    #      d. Upgrade the TCP socket to TLS (servername: outlook.office365.com)
    #      e. Wait for POP3 "+OK" greeting
    #
    #    WITHOUT PROXY:
    #      a. TLS connect directly to outlook.office365.com:995
    #      b. Wait for POP3 "+OK" greeting
    pop3.connect(proxy)

    # 4. AUTHENTICATE VIA XOAUTH2
    #    Build SASL string: "user=email\x01auth=Bearer access_token\x01\x01"
    #    Base64 encode it
    #    Send: AUTH XOAUTH2
    #    Server responds: + (ready for credentials)
    #    Send: base64_encoded_sasl_string
    #    Server responds: +OK (authenticated)
    pop3.authXOAuth2(email.email, accessToken)

    # 5. LIST & FETCH MESSAGES
    #    Send: LIST → get message numbers
    #    For each of the last N messages:
    #      Send: RETR msgNum → get raw email lines
    #      Parse headers (Subject, From, Date, Message-ID)
    #      Parse body (handle multipart/mixed, base64, quoted-printable)
    msgNums = pop3.list()
    for msgNum in last N of msgNums:
        rawLines = pop3.retr(msgNum)
        parsed = parseEmail(rawLines)

    # 6. DISCONNECT
    pop3.quit()

    return parsed emails (newest first)

Pseudocode for OAuth2 token refresh​

function refreshToken(emailAccount, proxy?):

    body = urlencoded {
        client_id:     emailAccount.client_id,
        refresh_token: emailAccount.refresh_token,
        grant_type:    "refresh_token",
        redirect_uri:  "https://login.microsoftonline.com/common/oauth2/nativeclient"
    }

    # WITH PROXY (HTTP CONNECT tunnel):
    #   1. TCP connect to proxy
    #   2. "CONNECT login.microsoftonline.com:443 HTTP/1.1"
    #   3. Wait for 200
    #   4. TLS upgrade over the tunnel
    #   5. Raw HTTP POST /common/oauth2/v2.0/token over TLS socket
    #   6. Read response, strip HTTP headers, parse JSON
    #
    # WITHOUT PROXY:
    #   Standard Node https.request POST

    response = JSON.parse(httpResponse)
    return response.access_token

Pseudocode for XOAUTH2 SASL string:​

function createXOAuth2String(email, accessToken):
    raw = "user=" + email + "\x01" + "auth=Bearer " + accessToken + "\x01\x01"
    return base64(raw)

Key tech​

1. No Microsoft Graph API — everything goes through raw POP3. The only HTTP call to Microsoft is the token refresh endpoint.
2. All proxy tunneling is manual — the code uses Node's net.connect() to open a TCP socket to the proxy, sends a raw CONNECT request, then wraps the socket in TLS via tls.connect(). This is done both for POP3 connections and for the OAuth token refresh HTTPS call. No high-level HTTP library handles the proxy.
3. Two separate POP3 reading functions:

• readEmails() — public-facing, uses default proxy, returns EmailMessage (subject, from, date, body preview truncated to 200 chars)
• readEmailsWithProxy() — internal, returns FullEmailMessage (full text + HTML body, raw headers). Used by findSubstackVerificationEmail() to search for verification links.

1. Email parsing is manual — the raw POP3 RETR output (RFC 2822 format) is parsed line-by-line: headers extracted, MIME multipart boundaries walked, base64/quoted-printable decoded. No external mail parsing library.
2. The refresh token never changes — Microsoft's endpoint can return a new refresh token in the response, but the code doesn't persist it back to the DB. It just uses the original one stored in emails.db each time.

 

[Rikachu]

Hotmail's long press verification is designed precisely to prevent bots from bypassing it, automated programs fail because they can't accurately mimic how a real finger presses a screen or mouse, it's difficult to circumvent.

Technically, there are programs that claim to be able to do it, but they're shady tools operating illegally, they're used to steal accounts or create fake profiles, and if you're caught using them, microsoft can permanently ban your IP address and device. It's not worth it.

If the problem is that it keeps asking for verification, the easiest solution is to not fight the system, download the outlook app on your computer and create the account from there, verification in the app is usually much simpler, sometimes just one step, use your regular wi-fi without any strange proxies, and you'll see that it lets you through much more easily.

 

[Elmago13]

In my automation, I programmed it to press and only release when the verified image appears. It's been working for over 4 months.

 

[Deleted member 1172552]

In my automation, I programmed it to press and only release when the verified image appears. It's been working for over 4 months.

selenium?

 

[Aerodex26]

isn't easier to just include a macro that holds the click for say 30 seconds or whatever?
because even if it's still holding it it will go through

 

[social_newbie]

Any update op, I encounterd same issue here

 

[bartosimpsonio]

Have you tried some AI solution? There's AI that takes over the browser these days

 

[Deleted member 1172552]

Have you tried some AI solution? There's AI that takes over the browser these days

Any update op, I encounterd same issue here

Hi, I fixed it. I am using undetected chromedriver, each keystores and clicks are randomized by miliseconds, when I select dropbox I move mouse around randomly and then simply click and hold it. it works, you definitely need to randomize the process in order to make it look like a person and you need stealth browser like undetected chromedriver, nodriver, etc.

 

[social_newbie]

Hi, I fixed it. I am using undetected chromedriver, each keystores and clicks are randomized by miliseconds, when I select dropbox I move mouse around randomly and then simply click and hold it. it works, you definitely need to randomize the process in order to make it look like a person and you need stealth browser like undetected chromedriver, nodriver, etc.

Apprecaited bro, then how do y detect the click area etc, i guess it maybe some kind of shadow dom? and y detect it directtly from python?

 

[Deleted member 1172552]

Apprecaited bro, then how do y detect the click area etc, i guess it maybe some kind of shadow dom? and y detect it directtly from python?

I am sending you through DM

 

[SIPSAMURAI]

Mmmm interesting... I believe cloud flare have a variant of this as well? Correct if I am wrong the waiting tunnel or whateve rits called. Its just keeps loading AGAIN...And again.. And again...