Loading story…
Researchers have identified a large-scale fraud operation dubbed FEMITBOT that abuses Telegram bots and Mini Apps to run cryptocurrency scams, phishing campaigns, and brand-impersonation schemes inside Telegram. The operation presents convincing in-app experiences through Telegram's built-in browser, including fake dashboards, fabricated account balances, urgent offers, and withdrawal prompts designed to pressure victims into depositing funds or completing referral tasks. Investigators linked the campaigns through shared backend infrastructure, including recurring API response patterns, and found that operators can quickly swap branding, languages, and scam themes spanning fake crypto platforms, financial services, AI tools, and streaming sites.
The same infrastructure has also been used to distribute malicious Android APK files and progressive web apps disguised as legitimate software and trusted brands, including BBC, NVIDIA, CineTV, CoreWeave, Claro, Apple, Coca-Cola, and Disney. Researchers said the APKs are often hosted on the same domains as campaign APIs, helping maintain valid TLS certificates and reducing browser warnings, while embedded Meta and TikTok tracking scripts monitor victim behavior and help optimize scam performance. The findings highlight Telegram Mini Apps as an effective delivery channel for both financial fraud and Android malware, particularly when users are persuaded to sideload apps or trust investment offers promoted through bots.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
CTM360 observed FEMITBOT distributing malicious Android APKs and progressive web apps masquerading as legitimate software from brands including BBC, NVIDIA, CineTV, Coreweave, and Claro. The report also noted the use of Meta and TikTok tracking scripts and warned users against interacting with Telegram investment bots or sideloading Android apps.
CTM360 researchers identified a large-scale fraud operation dubbed FEMITBOT that abuses Telegram bots and Mini Apps to conduct phishing and cryptocurrency-investment scams inside Telegram. The researchers linked campaigns through shared backend infrastructure, including a recurring API response string, and found the operation could rapidly switch brands, languages, and scam themes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcehackread.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET researchers uncovered dozens of fake **WhatsApp** and **Telegram** websites distributing trojanized Android and Windows installers aimed largely at Chinese-speaking users trying to access blocked messaging services outside official app stores. The malicious Android apps included the first observed **clipper** malware embedded in instant messaging clients, replacing cryptocurrency wallet addresses in chats so funds would be redirected to attacker-controlled accounts. Some samples also used **OCR** to scan screenshots and photos for wallet recovery phrases, while other variants exfiltrated messages, Telegram data, device details, and files. On Windows, the campaign delivered both Telegram clippers and bundled **remote access trojans (RATs)** that enabled keylogging, clipboard theft, screen capture, and file operations. Victims were lured through **Google Ads**, fraudulent YouTube channels, and counterfeit download pages impersonating legitimate messaging services. ESET said the operation reflects a broader cryptocurrency-theft ecosystem built around fake messaging apps and reported the malicious ads and channels to Google, which removed them.
Jul 12, 2026
Researchers reported that monetized URL shortener services and fake download pages were used to push **Android/FakeAdBlocker** and other malicious Android apps disguised as ad blockers or popular applications. Victims were funneled through aggressive advertising chains and prompted to install APKs with misleading names such as `adBLOCK app.apk`, after which the malware hid its icon, contacted command-and-control infrastructure, and fetched additional payloads. ESET said the campaign generated more than **150,000** Android downloads in the first half of 2021, while iPhone users were steered into fraudulent calendar-subscription scams rather than direct malware installs. The Android infections did not stop at adware. Researchers said the delivery chains also deployed banking trojans including **Cerberus**, **Ginp**, and **TeaBot**, alongside SMS trojans and other payloads, making the outcome dependent on the victim's region and the operators' current configuration. Separate reporting on Cerberus and Ginp described both as mobile banking malware families, and Bitdefender documented similar lures using mockups of well-known apps to spread **TeaBot** and **FluBot**, underscoring a broader ecosystem in which deceptive mobile install flows are used to distribute credential theft, financial fraud, and messaging abuse malware on Android.
Aug 14, 2026
Researchers reported two Android banking malware campaigns using staged droppers to evade detection and steal financial data from mobile users. Zscaler ThreatLabz said a fake **Document Reader** app on Google Play was downloaded more than 10,000 times before removal and later fetched the **Anatsa** payload from a remote server, while CYFIRMA identified **KYCShadow** being distributed through fake KYC verification apps sent over WhatsApp to bank customers in India. In both cases, the initial apps appeared legitimate, then installed secondary malicious components designed to bypass early screening and analysis. Once deployed, the malware sought high-risk permissions to hijack accounts, intercept SMS-based one-time passwords, and overlay banking apps to capture credentials. Anatsa was reported to target more than **831 financial institutions** globally, including banks and cryptocurrency platforms, using obfuscation and anti-analysis techniques, while KYCShadow collected data such as mobile numbers, Aadhaar details, ATM PINs, and card information, then used Firebase Cloud Messaging and a full-tunnel VPN for command-and-control and traffic redirection. Researchers urged users to uninstall suspicious apps and avoid software delivered through messaging platforms, and advised defenders to monitor indicators including `jsonapi[.]biz`, `jsonserv[.]biz`, and `jsonserv[.]xyz`.
Jun 29, 2026