Telegram has unfortunately become the platform of choice for malicious actors selling phishing bots and kits, as well as recruiting people who voluntarily help them.
While the messaging platform has been used for cybercriminal activities for several years, it appears that threat actors in the phishing industry have begun to rely more on it recently.
Researchers at cybersecurity firm Kaspersky have noticed a growing trend of people turning to phishing, forming an online community centered around phishing.
Phishing agents are heavily active on Telegram, offering services, as well as advice and free instructions.
See also: Outdated Windows UAC bypass allows phishing campaigns
See also: Phishing campaign exploits SharePoint to target users in the US and Europe
Phishing service offer
A report from Kasperksy notes that phishers are selling all types of phishing materials and services to interested buyers, including ready-made kits, fake pages, subscriptions to tools, guides, and technical support.
Researchers revealed the following services available today through Telegram:
- Free phishing kit with pre-packaged tools that allow users to create phishing pages imitating well-known brands.
- Automated (bot-based) creation of phishing pages and collection of user data.
- Premium phishing and scam pages with customizable interface, anti-bot systems, geo-blocking, URL encryption, and even social engineering elements. The cost of these kits ranges from $10 to $300, depending on their features.
- Stolen personal data and online banking credentials that are often verified.
- Phishing-as-a-service (PhaaS) subscriptions that provide access to tools, beginner guides, technical support, and regular updates for the provided anti-detection systems.
- One-time password (OTP) bots that help phishers automatically bypass 2FA (two-factor authentication) protections. These services are offered in subscription models at a suggested price of $130/week or $500/month for custom deployments.
To protect their own reputations, some vendors provide encryption kits that secure stolen data. This means that neither the vendor nor the operator can access the victim's personal information without first providing payment to each other.
Kaspersky says Telegram is also the place for would-be scammers to become more familiar with the phishing business for free.
More experienced phishers create Telegram channels with bots that provide step-by-step instructions for creating a phishing page.
See also: A new Emotet phishing campaign targets US taxpayers
The process is fully automated and ends with the creation of links to fake websites registered by the bot controller that imitate popular brands and services.
The final step for a novice phisher is to spread the links and wait patiently for the victims' confidential information to be transferred to his bot.
Using this approach, a skilled phisher can build trust with their target customer and gain access to the data they desire.
With Telegram providing the infrastructure for sellers, business has become not only easier but also more profitable. Furthermore, the platform’s bots do all the work for those involved in sales, which significantly lowers the barriers to entry, making it easier than ever for inexperienced threat actors or would-be phishers to enter this crime scene.
Over the past six months, Kaspersky has successfully detected more than 2.5 million malicious URLs created using phishing packets and prevented 7.1 million access attempts by users of its products during the same period – a truly impressive achievement!
This data is evidence of the remarkable scale of phishing activities, which could not have been achieved without the countless kits and services flooding the market – fueled by a thriving business model operating through Telegram.
Information source: bleepingcomputer.com
