{"id":5216,"date":"2025-07-15T14:58:46","date_gmt":"2025-07-15T14:58:46","guid":{"rendered":"https:\/\/adex.com\/?p=5216"},"modified":"2025-07-15T14:58:48","modified_gmt":"2025-07-15T14:58:48","slug":"phishing-alert-telegram-fraud","status":"publish","type":"post","link":"https:\/\/adex.com\/blog\/phishing-alert-telegram-fraud\/","title":{"rendered":"[Phishing Scam Alert] Telegram Fraud and Account Hijacking Prevented"},"content":{"rendered":"\n

<\/p>\n\n\n\n

New ad formats and emerging traffic sources open up opportunities for growth, but they also create loopholes that fraudsters are quick to exploit. Telegram has become one of the fastest-growing traffic sources for advertisers over the past two years, making it a prime target for scammers.<\/p>\n\n\n\n

In this article, we break down a recent phishing attempt aimed at hijacking Telegram accounts \u2013 and show how Adex specialists detected and stopped it.<\/p>\n\n\n\n

\n\n\n\n

Mobile subscription offers under attack<\/strong><\/h2>\n\n\n\n

Many mobile subscription offers rely on a simple mechanics: the user enters their phone number, receives a confirmation code, and then submits that code to complete the subscription. While most advertisers prefer sending these codes via SMS for reliability, some try more budget-friendly channels like WhatsApp, Telegram, or other messengers to deliver the confirmation code.<\/p>\n\n\n\n

Since mobile subscriptions are vulnerable to fraud, Adex specialists routinely check these campaigns to make sure nothing suspicious slips through.<\/p>\n\n\n\n

\n

During a standard check, Adex specialists noticed something unusual about an ad campaign and suspected it was fraudulent. At first glance, though, the ad looked like a regular mobile subscription offer.<\/p>\n<\/blockquote>\n\n\n\n

However, when our experts decided to double-check, they discovered that the ad campaign was actually a phishing scheme targeting Telegram accounts.<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"Adex<\/figure>
\n

ADEX Discovers: Potential DNS Vulnerability and 3rd Party Fraud on FC Barcelona\u2019s Official Website<\/a><\/strong><\/p>\n<\/div><\/div>\n\n\n\n

\n\n\n\n

Fraud mechanics<\/strong><\/h2>\n\n\n\n

This fraud exploited users’ lack of attention and advertisers’ desire to save money by avoiding standard SMS services.<\/p>\n\n\n\n

Here\u2019s how it worked:<\/strong> On a landing page disguised as a standard mobile subscription form, the user would enter their phone number. Next, they\u2019d receive a message in their Telegram messenger containing an authorization code. An unsuspecting user would then enter that code back on the landing page to \u201cconfirm\u201d their phone number, and immediately lose access to their Telegram account.<\/p>\n\n\n\n

\n

Verifying this scheme was complicated by the fact that a valid phone number from a limited list of countries was required to do so.<\/p>\n<\/blockquote>\n\n\n\n

Once we obtained the needed number, we confirmed that after a user entered their phone number, they received an actual Telegram login code. Submitting that code on the scammer\u2019s page granted the attackers access to the victim\u2019s account. <\/p>\n\n\n\n

\n
\"\"<\/a><\/figure>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
\"\"<\/a><\/figure>\n<\/figure>\n\n\n\n
\n\n\n\n

Expanded investigation: More campaigns uncovered<\/strong><\/h2>\n\n\n\n

With a better understanding of the fraudulent scheme, we scaled up our checks and reviewed similar campaigns. This led us to spot several more advertisers promoting the same phishing sites.<\/p>\n\n\n\n

These landing pages came in many variations, but all of them had one thing in common: they asked the user to “confirm” something by entering their phone number. Below are some of the domains hosting these landing pages:<\/p>\n\n\n\n