Loading threat actor…
FEMITBOT is a large-scale fraud and malware distribution operation that abuses Telegram bots and Mini Apps to run cryptocurrency investment scams and deliver malicious Android software. The operation uses Telegram’s in-app WebView to make fraudulent pages appear native to the platform, increasing user trust and reducing friction during victim interaction. It is characterized by centralized backend infrastructure that supports rapid reuse across many concurrent campaigns, with operators able to swap branding, themes, and languages at scale. FEMITBOT commonly impersonates well-known consumer, technology, media, financial, and cryptocurrency brands to lend credibility to scam offers. Victims are typically lured through social media advertising and unsolicited Telegram invitations, then presented with polished interfaces showing fabricated balances, fake earnings dashboards, countdown timers, expiring offers, and VIP-style upgrade prompts. The workflow pressures victims into depositing funds or recruiting additional users before purported withdrawals are allowed, consistent with organized investment fraud and referral-based scam mechanics. The operation also functions as a malware delivery platform. Some campaigns push malicious Android applications or Progressive Web Apps masquerading as legitimate software, using Telegram-delivered flows and direct download prompts to induce installation. Researchers have linked the activity to a shared kit identified by a recurring backend string associated with the FEMITBOT name, along with a large ecosystem of Telegram bots, impersonated brands, and advertising telemetry used to optimize lure performance. The infrastructure supports multilingual targeting and uses traffic measurement and campaign analytics associated with major advertising platforms, indicating a professionalized and business-like operating model. High-confidence observed behaviors include initial access through social engineering, credential- or session-related abuse via Telegram authentication data, financial theft through fraudulent deposits, malware delivery, and infrastructure concealment measures. FEMITBOT is best understood as an organized cyber-enabled fraud network focused primarily on financial gain rather than espionage or disruption.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.