This malicious Telegram bot could create huge phishing scams

A fish hook is lying across a computer keyboard, representing a phishing attack on a computer system
(Image credit: weerapatkiatdumrong / Getty Images)

Cybersecurity researchers from ESET recently discovered a new toolkit that allows even the lowest-skilled hackers to pull off elaborate phishing schemes. The toolkit is called Telekopye and it’s implemented as a Telegram bot which hackers can use to generate fraudulent websites and landing pages, send SMS messages and emails, and create fake screenshots.

The targets are mainly online markets popular in Russia, such as OLX and YULA. However, ESET’s researchers also saw hackers targeting marketplaces native to other countries, such as BlaBlaCar, and eBay. In some instances, victims had nothing in common with Russia, such as Jófogás and Sbazar.

There are three ways criminals can use Telekopye - to scam buyers (twice) and to scam sellers. When it comes to scamming buyers, the attackers create a fake purchase site and navigate the victims there, to pay online. The site harvests sensitive information such as online banking logins, credit card details (sometimes even account balances), and more.


Reader Offer: $50 Amazon gift card with demo

Reader Offer: $50 Amazon gift card with demo
Perimeter 81's Malware Protection intercepts threats at the delivery stage to prevent known malware, polymorphic attacks, zero-day exploits, and more. Let your people use the web freely without risking data and network security.

Preferred partner (What does this mean?

"Rats" everywhere

Hackers can also scam people looking for refunds in the same manner - by sending a link to a phishing site. Victims would think they were applying for a refund when in reality they were getting their data stolen.

Finally, when scamming sellers, the hackers would reach out to the company, claiming they had already paid for the item and that they were now looking for a refund. The victim seller would then get a link “proving” the purchase, which would then be used to siphon out sensitive data.

The tool is still being developed and improved upon, ESET added. The developers promoting it in various places, including underground forums, and they’re straightforward in their ads - the tool is used to scam online marketplace users. 

They’re also aware that the group is full of “rats” (law enforcement) and encourage users to be quiet and work. Any inquiries into any information that could identify other members of the group result in a ban.

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Android phone malware
This nasty Android malware is posing as the Telegram Premium app
A fish hook is lying across a computer keyboard, representing a phishing attack on a computer system
Everything you need to know about phishing
Someone checking their credit card details online.
Hackers use CAPTCHA scam in PDF files on Webflow CDN to get past security systems
Image depicting hands typing on a keyboard, with phishing hooks holding files, passwords and credit cards.
Microsoft warns about a new phishing campaign impersonating Booking.com
Telegram
New Golang malware is hijacking Telegram to help itself spread
Ai tech, businessman show virtual graphic Global Internet connect Chatgpt Chat with AI, Artificial Intelligence.
AI agents can be hijacked to write and send phishing attacks
Latest in Security
cybersecurity
Chinese government hackers allegedly spent years undetected in foreign phone networks
Data leak
A major Keenetic router data leak could put a million households at risk
Code Skull
Interpol operation arrests 300 suspects linked to African cybercrime rings
Insecure network with several red platforms connected through glowing data lines and a black hat hacker symbol
Multiple routers hit by new critical severity remote command injection vulnerability, with no fix in sight
Code Skull
This dangerous new ransomware is hitting Windows, ARM, ESXi systems
An abstract image of a lock against a digital background, denoting cybersecurity.
Critical security flaw in Next.js could spell big trouble for JavaScript users
Latest in News
DeepSeek
Deepseek’s new AI is smarter, faster, cheaper, and a real rival to OpenAI's models
Open AI
OpenAI unveiled image generation for 4o – here's everything you need to know about the ChatGPT upgrade
Apple WWDC 2025 announced
Apple just announced WWDC 2025 starts on June 9, and we'll all be watching the opening event
Hornet swings their weapon in mid air
Hollow Knight: Silksong gets new Steam metadata changes, convincing everyone and their mother that the game is finally releasing this year
OpenAI logo
OpenAI just launched a free ChatGPT bible that will help you master the AI chatbot and Sora
An aerial view of an Instavolt Superhub for charging electric vehicles
Forget gas stations – EV charging Superhubs are using solar power to solve the most annoying thing about electric motoring