Loading story…
Researchers uncovered a highly tailored Telegram phishing operation that targeted at least one exiled Belarusian activist in Lithuania as well as users in Belarus, Russia, and Kazakhstan. The campaign used fake Telegram security alerts delivered through secret chats and individualized phishing links that embedded victims’ phone numbers, then presented a counterfeit login page designed to steal Telegram one-time passcodes. By capturing valid OTPs instead of deploying malware, the operators could immediately hijack accounts if victims entered the code before it expired.
The infrastructure showed signs of sustained regional activity, with RESIDENT.NGO linking the operation to broader OTP-phishing campaigns tracked for roughly two years across Russia, Belarus, and Kazakhstan. Investigators said the phishing links used device-aware filtering to display the fake login page only to intended targets while redirecting others to benign content, and also collected metadata including device details, timing, and ISP information from visits. That intelligence was reportedly used in follow-up messages to increase credibility and pressure targets, underscoring a persistent focus on account takeover against Belarusian civil society and other regional Telegram users.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
The Record reported that the same phishing operation also targeted additional users in Belarus, Russia, and Kazakhstan. The report said researchers could not confirm how many people were targeted or whether any Telegram accounts were ultimately compromised.
Researchers documented a highly personalized Telegram phishing operation targeting at least one exiled Belarusian activist in Lithuania, with activity ongoing since at least October 2024. The attackers used fake Telegram security alerts in secret chats and individualized phishing links containing victims' phone numbers.
RESIDENT.NGO published an analysis of the Telegram phishing operation targeting an exiled Belarusian activist. The write-up detailed tactics including device-aware filtering and collection of device, timing, and ISP data to support follow-up social engineering.
RESIDENT.NGO reported a regional Telegram one-time-passcode phishing infrastructure targeting users in Russia, Belarus, and Kazakhstan for two years. The campaign used Telegram-focused phishing to steal login codes for account takeover.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourceresident.ngo
Open sourceresident.ngo
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research reported that the **Rampant Kitten** espionage campaign targeted Iranian expats, dissidents, minorities, and anti-regime organizations in a long-running intelligence-gathering operation attributed to Iran-linked actors. The activity focused on collecting sensitive victim data, including **Telegram Desktop** files, **KeePass** password data, documents, and SMS-based two-factor authentication codes, indicating a strong emphasis on surveillance of perceived opponents of the Iranian regime. Researchers tied the operation to multiple malware families and infrastructure clusters active since 2014, including **TelB**, **TelAndExt**, a Python infostealer, and **HookInjEx**. The attackers used several delivery methods across platforms, including malicious documents, fake software downloads, phishing pages impersonating Telegram, Windows infostealers, and an Android backdoor, showing a sustained and multi-vector effort to compromise targets and exfiltrate communications and credentials.
Aug 15, 2026
Citizen Lab and Access Now documented a sophisticated spear-phishing campaign targeting Russian opposition figures, Belarusian and Russian civil society groups, independent media, international NGOs active in Eastern Europe, policy experts, funders, journalists, and at least one former U.S. ambassador. Researchers attributed one cluster to **COLDRIVER**—also tracked as **Star Blizzard**, **Callisto**, **TA446**, **Blue Charlie**, and **UNC4057**—a Russia-linked threat actor that multiple governments have associated with the FSB’s Centre 18, while identifying a separate but related phishing cluster as **COLDWASTREL**. The operations used highly personalized impersonation emails sent from compromised or lookalike accounts, along with fake encrypted or protected PDF lures that redirected victims through fingerprinting infrastructure to credential-harvesting pages spoofing services such as Gmail and ProtonMail. Investigators found overlaps with known COLDRIVER tradecraft, including Hostinger-registered domains, Let’s Encrypt or ZeroSSL certificates, LibreOffice 7.0 PDF metadata, randomized author names, and occasional HubSpot links, while COLDWASTREL showed distinct metadata, infrastructure, and domain patterns. The groups sought passwords, two-factor authentication codes, and session cookies, raising the risk of exposing sensitive identities, communications, relationships, and locations of organizations already facing Russian government repression.
Jul 12, 2026
Researchers have identified sophisticated phishing campaigns targeting users of major web hosting and email services, employing advanced techniques to steal credentials and payment information. In one case, customers of Aruba S.p.A., a leading Italian web hosting provider, were targeted with phishing emails that mimicked official notifications about expiring services or failed payments. Victims were directed to fake login and payment pages, where their email addresses were pre-filled to enhance credibility. The phishing kit used in this campaign incorporated CAPTCHA filtering to evade detection and utilized Telegram bots for real-time exfiltration of stolen credentials and credit card details. A parallel campaign has been observed where users receive fake spam filter alerts, claiming that important emails have been blocked due to a supposed system upgrade. These emails, appearing to originate from the recipient's own domain, prompt users to log in via a link to a spoofed webmail page, again with pre-filled email addresses. The phishing sites employ tactics such as repeated invalid login prompts to harvest passwords and use obfuscated code and websockets for instant credential theft. In both campaigns, Telegram is used as the primary channel for attackers to receive stolen data, highlighting a trend in the use of messaging platforms for cybercriminal coordination and data exfiltration.
Jun 29, 2026