Users receive offers to check their activity for a Premium subscription or "stars" (Telegram's internal currency). Links to these offers are spread through TikTok and lead to phishing sites or malicious bots.
F6 noted that typical names of such resources include "Your Results 2025," "Yearly Results," and "Your 2025" (quote from TASS).
When requesting login data, the bots also ask for a "confirmation code," which is actually a security code. Once obtained, the fraudsters gain access to the victim's account. Additionally, users may be forced to subscribe to numerous "sponsored" channels, hiding subscription buttons under inline buttons in messages.
Last week, another fraudulent scheme was discovered in Telegram, disguised as a "Secret Santa" game. Attackers are sending invitations to participate and receive a gift from an unknown sender, urging recipients to click on phishing links. This can lead to the automatic installation of malware, giving fraudsters remote access to the user's device.
