Telegram Phishing Campaign Targets Belarusian Activist, Russian, and Kazakhstani Users

Targeted Phishing Operation

Digital security organization Resident NGO has documented a sophisticated Telegram phishing campaign. This operation specifically targeted an exiled Belarusian activist residing in Lithuania, alongside a broader set of users in Russia and Kazakhstan. The campaign has been active since at least October 2024.

Attack Methodology

The attack began with a fake Telegram security alert sent via the app's end-to-end encrypted secret chat feature. The message, originating from an unfamiliar account registered to a Kazakhstani phone number, falsely claimed the victim had violated Telegram's rules and threatened account blockage unless a verification link was clicked. One targeted user recognized the attempt and reported it to Resident NGO.

Personalized Links and Account Takeover

Researchers found that each phishing link was uniquely crafted for a specific individual, embedding their phone number to track interactions. Instead of deploying malware, the attackers aimed to trick victims into entering Telegram's one-time login code. If entered before expiration, this code would grant attackers immediate control over the victim's Telegram account. Resident NGO identified 64 distinct phone numbers, predominantly Russian, embedded in these individualized links.

Advanced Evasion Techniques

A notable aspect of the campaign was its sophisticated infrastructure. Before displaying the phishing page, the attackers checked the visitor's browser and device. Only if the visitor matched the intended target was the fake Telegram login page shown. Security tools and many desktop users were redirected to Telegram's legitimate website or other harmless pages, making the attack significantly harder to detect by general security measures.