{"id":24520,"date":"2025-08-13T07:19:51","date_gmt":"2025-08-13T11:19:51","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/?p=24520"},"modified":"2025-08-20T16:25:28","modified_gmt":"2025-08-20T12:25:28","slug":"phishing-and-scam-in-telegram-2025","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/phishing-and-scam-in-telegram-2025\/24520\/","title":{"rendered":"Telegram scams with bots, gifts, and crypto"},"content":{"rendered":"

Remember the early days of the internet and 419 (aka \u201cNigerian prince\u201d) scams<\/a> promising mountains of gold just for you?\u00a0That era is thankfully over, but today a new curse is all the rage: messenger phishing. Due to its vast user base, the openness of its API, and support for crypto payments, one particular messenger \u2014 Telegram<\/a> \u2014 has become a very popular choice for phishing cybercriminals. So what new tricks do Telegram scammers employ, and how can you spot them in time?\n<\/p>\n

Telegram bots in the service of cybercriminals<\/h2>\n

\nTelegram is home to a huge array of bot-related scams. And sometimes attackers offer their bots to other bad guys to create new ones. If you\u2019re feeling a bit overwhelmed, don\u2019t worry: our Securelist blogpost<\/a> takes a detailed look at this phenomenon \u2014 known as phishing-as-a-service.<\/p>\n

Attackers often use Telegram bots instead of websites. It\u2019s much easier to lure potential victims this way; it\u2019s far harder to create and maintain a full-fledged phishing site and get victims to swallow the bait. With bots, everything\u2019s simpler since users don\u2019t need to leave Telegram, which many mistakenly think is a safe environment by default.<\/p>\n

So what does it look like in practice? One example is a new scam involving cryptocurrency investments: \u201cWe\u2019re handing out a new token to everyone\u00a0\u2014 just enter the bot and go through KYC verification\u201d. <\/em>Of course, \u201cKYC verification\u201d for scammers doesn\u2019t mean a passport photo or a video call to confirm your identity, but depositing a sum of cryptocurrency. And, yes, this crypto goes straight into the attackers\u2019 account, while you get zilch.<\/p>\n

\"Telegram<\/a>

Telegram bot offers fake KYC verification<\/p><\/div>\n

Sure, Telegram bots aren\u2019t limited to extracting crypto. For instance, we uncovered a scam inviting victims to get paid for watching short videos. Where? In a Telegram bot, of course.<\/p>\n

Victims \"earn\" two euros per video view<\/a>

Victims \u201cearn\u201d two euros per video view<\/p><\/div>\n

Telegram bots are highly intrusive\u00a0\u2014 if you don\u2019t block them, they\u2019ll keep knocking on your door. Most phishing sites don\u2019t do this; user interaction with them plays out differently: visit the site, browse, leave. But chat with a Telegram bot just once, and it\u2019ll bombard you with suspicious links or pester you for access to manage your channels and groups. If you grow tired of an intrusive bot, just block it: open a dialog with the bot, tap its name, then select Block<\/strong>. That done, the pesky bot will message you no more.<\/p>\n

In another nasty bot-related scam, attackers persuade victims to start bot chats, then share their data or send money. Once the victim is hooked, the scammers rename the bot Telegram Wallet or Support Bot (mimicking supposedly official channels), transfer ownership of the bot to the victim\u2019s account without their knowledge, and report it to Telegram support. Thinking it was the victim who created the bot, Telegram support deletes not only the bot, but also the victim\u2019s account. The scammers do this to cover their tracks and muddy the waters for a possible police investigation.\n<\/p>\n

Fake gifts and account theft<\/h2>\n

\nAttackers employ a variety of tricks to gain access to victims\u2019 accounts. One of the most common scams is a \u201cgift\u201d subscription to Telegram Premium. Check out our post You\u2019ve been sent a \u201cgift\u201d \u2014 a Telegram Premium subscription<\/strong><\/a> for details. In brief: scammers message victims from the hacked account of a friend, prompting them to go to a phishing site to \u201cfinalize the subscription\u201d. There\u2019s no subscription, of course. Instead, victims have their own accounts stolen.<\/p>\n

Another new vector of fraud involves Telegraph<\/a>, Telegram\u2019s tool for posting longer texts. Anyone can publish content there, and no prior registration is required, which is what attackers exploit since it\u2019s easy to redirect users to phishing pages. The result, as a rule, is one more hijacked account.<\/p>\n

\"The<\/a>

The user is lured into following the link to view the full version of the document<\/p><\/div>\n

What else have scammers and phishers come up with? Threat actors are actively using AI to create deepfakes, steal biometric data, hide phishing attacks under temporary Blob URLs, and even spoof Google Translate subdomains. Read about these and other trends in our Securelist report<\/a>.\n<\/p>\n

How to guard against Telegram scams and phishing<\/h2>\n

\nThe best tip is to apply critical thinking at all times. But even the smartest of us can sometimes act rashly, so try to read up on scams as much as possible so that your muscle memory automatically triggers the right response.\n<\/p>\n