Telegram Mini Apps Abused for Crypto Scams and Android Malware Delivery

Researchers have identified a large-scale fraud operation dubbed FEMITBOT that abuses Telegram bots and Mini Apps to run cryptocurrency scams, phishing campaigns, and brand-impersonation schemes inside Telegram. The operation presents convincing in-app experiences through Telegram's built-in browser, including fake dashboards, fabricated account balances, urgent offers, and withdrawal prompts designed to pressure victims into depositing funds or completing referral tasks. Investigators linked the campaigns through shared backend infrastructure, including recurring API response patterns, and found that operators can quickly swap branding, languages, and scam themes spanning fake crypto platforms, financial services, AI tools, and streaming sites.

The same infrastructure has also been used to distribute malicious Android APK files and progressive web apps disguised as legitimate software and trusted brands, including BBC, NVIDIA, CineTV, CoreWeave, Claro, Apple, Coca-Cola, and Disney. Researchers said the APKs are often hosted on the same domains as campaign APIs, helping maintain valid TLS certificates and reducing browser warnings, while embedded Meta and TikTok tracking scripts monitor victim behavior and help optimize scam performance. The findings highlight Telegram Mini Apps as an effective delivery channel for both financial fraud and Android malware, particularly when users are persuaded to sideload apps or trust investment offers promoted through bots.