The main target of the new wave of attacks are journalists and bloggers, AntiMalware writes. After gaining access to their accounts, attackers can try to take control of popular Telegram news channels. Such sites are then often used to publish fake news or place fraudulent advertisements.
The scheme itself has not changed much over the past few years. The user receives a message allegedly from an acquaintance whose account has already been hacked. The text says roughly the following: “Hi. Can you help? A girl from the family of our acquaintances – Nastya – is participating in a charity drawing contest. If she wins first place, she will be given a grant for treatment.”
A link to the voting site is attached to the message. However, it actually leads to a phishing page that mimics the Telegram login procedure.
The main innovation of the scammers was the mention of a grant for treatment. This element is designed to elicit an emotional response from the user and should increase the likelihood of clicking on the link.
According to information security expert Evgeny Egorov, the attackers created a network of about 290 domains to conduct such a campaign. They are registered in the zones.com.tr, .xyz, .shop, .cyou, .cfd and .icu and copy the appearance of the Telegram login page.
The fake sites use the wording “Vote Verification System” instead of the usual “Telegram Login” caption. The user is offered to confirm participation in the voting by entering a code from an SMS. In fact, this code is designed to authorize a new device in the Telegram account. If you enter it on the fake page, fraudsters get full access to the account.
