Telegram scammers targeting users with malware

[Charles-Tim]

I have joined some Telegram groups before. When you joined or if you post on the group, you will see some scammers that will send you message to chat with you. Convincing you that they are working in group and the project. But they are all scammers. What I noticed before was that they will give you a fake link and tell you to connect your wallet. If you connect your wallet, I am not sure maybe you will still be the one that will make payment into the scammers address, but I do not think so because victims complained that all the money on their wallet are stolen with the Telegram scam.

So I do not know if this malware is truly new or not, but it is worth knowing. Although, it is just like before, if you avoid the fake Telegram groups, you will avoid the malware. Scam Sniffer posted on X that the malware is through a bot. And that it can compromise your crypto wallets and your device.

Once in the Telegram group, users are immediately prompted to verify through OfficiaISafeguardBot. This fake bot creates artificial urgency with extremely short verification windows. The verification process secretly injects malicious PowerShell code into your clipboard. When executed, it downloads and runs malware that can compromise your system and crypto wallets.

https://x.com/realScamSniffer/status/1866465802020602074?t=9ZtgnfEyENZpJvmGI2gDwQ&s=19

Code:

https://x.com/realScamSniffer/status/1866465802020602074?t=9ZtgnfEyENZpJvmGI2gDwQ&s=19

If you click on the link and you are not logged in through browser, you will not see all the Scam Snuffer's posts. You can click on the link in code which can suggestion you to read it on your Telegram app where you will see all the posts, provided if you have X installed on your device.

[lovesmayfamilis]

Any link sent to you from a stranger should be viewed with distrust. Telegram fraud has become very sophisticated these days. In my country, they spread a message like, "Look, you're on the news," or ask, "Is that you in the photo?" and send a file with the extension ... apk. After you click on the link, all your funds are debited from your cards if they are linked to your phone. The same thing happens with the distribution of fake links from our Telegram crypto groups that we subscribe to receive news. We don't know the people who sent the links, and we shouldn't trust them. But there is another thing: scammers have learned to hack Telegram accounts. Even after receiving a link from people you know, still be extremely careful. Sometimes bad things can be sent from acquaintances.

[cryptoaddictchie]

Golden rule in telegram if you dont know the person or someone talking to you he is a scammer until otherwise rproven legit user from a project. I often got dm with such introductions and ofcourse these scammers even use legit or verified users. I have not yet fallen into the likes of these modus since I am not gonne be swayed by such offer even though its so good.

[knowngunman]

While we're being cautious about scams, telegram is proven to remain the number one scammers eden. It baffles me how these scammers are improving on their strategies as technology is improving and telegram has been the leading channel they carried out their evil acts. That being said, isn't it carelessness to join any group that comes our way? I believe if you have anything to lose, you'll definitely be careful clicking on strange links. Moreover, reputable projects don't restrict access to their groups, you don't need to pass through bot verification to prove your humanity. I like the idea of most projects and influencers representatives adding "never dm you first" to their names to minimise the case of impersonation.

[hugeblack]

The easiest way is to customize your privacy and security settings so that only people registered on your phone can contact you(remove your username and use TG with temp phone number)

[GiftedMAN]

Since I noticed that scammers are more in telegram space than other notable social media platforms, joining groups on telegram has been minimized despite having some good groups that has proven to be legit on telegram.

You see the idea of connecting my wallet address to any link from telegram, I doubt if I will fall for the scam again after hearing the stories of people that have lost control of their wallet and the funds inside of it.

People should just be mindful of the groups they quickly rush to get into and they should try not to clink any link they see on the groups because most people do not know what happens next after clicking on links that was sent to them through telegram.

[EluguHcman]

I have joined some Telegram groups before. When you joined or if you post on the group, you will see some scammers that will send you message to chat with you. Convincing you that they are working in group and the project. But they are all scammers. What I noticed before was that they will give you a fake link and tell you to connect your wallet. If you connect your wallet, I am not sure maybe you will still be the one that will make payment into the scammers address, but I do not think so because victims complained that all the money on their wallet are stolen with the Telegram scam.

So I do not if this malware is truly new or not, but it is worth knowing. Although, it is just like before, if you avoid the fake Telegram groups, you will avoid the malware. Scam Sniffer posted on X that the malware is through a bot. And that it can compromise your crypto wallets and your device.

Whether it is a new malware or not, the key point is that it is a vital shared information so that others who have not learnt about it will be updated and stay cautious on joining telegram groups. Especially those ones that basically discusses about enhancing members opportunities to earn money without going in details the foundation of the organization or platform.
Infact, I am rather preferred not clicking an unknown link because such is a means to make your device vulnerable to scammers.

Even, once I am asked to connect my wallet to the platform, I am immediately twice thinking of malicious intentions and that is even why I am rare to participate on most bounty projects that requires connecting of wallet to enable payment.

 

[Majestic-milf]

 Telegram is the hub for scammers so when you join a group that immediately prompts you to link your wallet, that should send alarm bells through you and most times these scammers present a very credible looking proposal that would seem so convincing that if one's not careful, they will fall but they will always have something that would give them away to be dubious and full of scam so what I do when I see such "projects" I just ignore. Good thing I'm not always on telegram.

[xLays]

Golden rule in telegram if you dont know the person or someone talking to you he is a scammer until otherwise rproven legit user from a project. I often got dm with such introductions and ofcourse these scammers even use legit or verified users. I have not yet fallen into the likes of these modus since I am not gonne be swayed by such offer even though its so good.

Even if you know or trust someone, it's always best to be cautious with links they send, as their accounts could be compromised or they might accidentally share malicious links. Always verify the source of link and avoid clicking on anything suspicious.

There are some decent and real airdrops on Telegram, but be careful. Scammers may pretend to be real projects to steal your info or money. Always check if the project is real, never share private keys or connect wallet. Confirm details from their official website or channels before joining.

[SquirrelJulietGarden]

Any link sent to you from a stranger should be viewed with distrust. Telegram fraud has become very sophisticated these days.

Links, files like animated images, videos need to be ignored and avoid to download them.

How to disable auto media download in Telegram.

Turning the automatic download feature for your Telegram account, and avoid clicking on any unsolicited links and files.

Even if you know or trust someone, it's always best to be cautious with links they send, as their accounts could be compromised or they might accidentally share malicious links. Always verify the source of link and avoid clicking on anything suspicious.

On devices I log in my email, accounts and have my wallets, I am more carefully with practice and don't click on links automatically without a little consideration time. I agree with you that any account has risk to be compromised, so OPSEC, I don't intend to easily clicking on anything.

[un_rank]

I rarely join telegram groups and do not get unsolicited messages at all. Someone using their telegram as a means of finding crypto projects or joining crypto groups to share knowledge will run the risk of getting scam messages. If you are in that situation, never reply to any unsolicited messages, do not click links and always report such messages when you get them.

Your privacy setting will also protect you from being added to random groups or receiving random messages.

- Jay -

[nakamura12]

They also message you a question like do you want to earn profit by investing and then give you a website that the system on how people earn is through pyramid scheme which in my opinion is a scam although I don't have any proof but as we know that pyramid scheme or ponzi scheme is known by many people and how it is used to scam people. This is exactly what happened to me where someone sent me a pm and I pretended to be interested which I am not and also I received a message as well where he asked me if I want to buy bitcointalk account for money. People should be very careful about telegram groups and people who sent you dms on telegram.

[Wiwo]

The easiest way is to customize your privacy and security settings so that only people registered on your phone can contact you(remove your username and use TG with temp phone number)

Alot of telegram users leave they security amd privacy settings at default which gives stranger's access to messagthem freely?, but those that took extra step to customise their privacy settings have less chance of communicating with any scammers or strangers trying to reach them that is that about telegram.

Back to ops questions as to what gives the scammer access to steal funds from a wallet that is connected to their smart contract, if I am not mistaken, some smart contracts have security settings that grant them transaction access to any wallet connected to them and even have access to both the pin and other secure features of the wallet, so for that the victim's funds are at the mercy of the scammers when there are already into the wallet.

[uchegod-21]

I have always seen telegram as the play ground of scammers. Whoever is trading there or using it should be very conscious and careful. Someone in the barracks should be very careful of bullets and not someone sleeping in his room.

Generally, if someone sent you a link, it is suspicious and be treated with care, let alone being set a link from the scammers abode.

[Obim34]

The easiest way is to customize your privacy and security settings so that only people registered on your phone can contact you(remove your username and use TG with temp phone number)

Yea... the first step after signing up ones telegram account is to set up every privacy and security datas. In the case of using temp number on the TG may not be easily applicable to everyone, easiest way is to hide the number through the privacy settings and it won't be displayed either.

Since I noticed that scammers are more in telegram space than other notable social media platforms, joining groups on telegram has been minimized despite having some good groups that has proven to be legit on telegram.

Telegram is no social media as of what it is today, that's a hub for scammers. This should have been known already, any unidentified DM from anyone is an absolute scam, most of them comes in as investors many brings the idea of them trading for you and giving out returns of profits after weekly trade which is also false, that's a bid to reap off your funds.

[nakamura12]

Yea... the first step after signing up ones telegram account is to set up every privacy and security datas. In the case of using temp number on the TG may not be easily applicable to everyone, easiest way is to hide the number through the privacy settings and it won't be displayed either.

Well, it's not necessarily to use your number. For much better than just hiding phone number is you should use another phone number that you don't use for personal reasons and It is more like a dummy phone number that you have to keep in case you need to access an OTP. Another way for scammers to know on how to contact you is when they know your telegram username like when you and a scammer are in the same group then he can send you a message. Another one is you shouldn't entertain such attempts.

[PX-Z]

This is not related to malware on TG but I just got a detected login to my one account today at 5 am (was sleeping just got awake from the call) which was the very first time to happen in my tg account.
- First i got a message from tg of login code that someone trying to access my account, this is only will happen if they know your number knowing this number were including on different breached like Ledger so probably many have this number of mine on their db lists
- then after minute someone call from overseas i didnt answer of course since i didnt know who was it.
- moments later i got new message of detected login from new device "Telegram Android, 11.5.3 MBOX Android 11 (30)"
- set 2fa (received a message on this too)
- then i noticed an email was linked as well which i never did before, probably it was from that user

So what i did is;
- first go to device then terminate the session of the new device, just after i received the call (after a woke up)
- removed the email, it was snipped i can't fully see the email id just the first and last character, then i changed it to mine (first time doing that)
- add passcode
- then reset 2fa

This account is not my main tg never had any convo to strangers i just used it to test my TG bots, since i know this number was leaked to different list already but it weirded me out that just a missed call from unknown number it got successfully login to the account. Which i think that instead of passcode from the app, the call (probably from telegram) was used for the verification then logged in.
Note my privacy settings were all set to "nobody", so no one can see my phone number, calls, last seen, contact list, etc.

This is the number used with label "Malaysia"

[tabas]

Even in legitimate crypto telegram groups, these scammers are also there. They'll try to message the newly joined members and if that member is not aware of this tactic they do, they're likely to fall for this trap that they set. I think it's always worth noting that if you haven't messaged anyone, don't entertain it from strangers. And if they ask you to visit a link and if it asks for you to connect to your wallet, that's already a sign of it as a red flag. It's scary for those that are unaware of it if these links are automated and trying to connect automatically the wallets and if you're the kind of "yes guy" and just clicks yes/agree, you're in danger.

[DYING_S0UL]

~snip~

Something similar once happened with one of my friends. He rarely used his TG account and and one day some Russian guy somehow hacked his account. All of his personal details were private, numbers and everything and he had 2fa on. But still the hacker was able to got hold of his account. Later we (I was with him) tried to recover the account, but the recovery code wasn't coming. And at the same time the hacker was threatening us by saying he would hack all our accounts. He used all kinds of slang vulgar words like asshole,mother****. Unfortunately we couldn't recover it. We had to abandon that account though it didn't contain much information or anything.

[Samlucky O]

Telegram has been the latest home for crypto scammers. You can see how many airdrop has flooded telegram and comes with much  promises leading to many people losing there asset to scammers. Though some projects are real but majority are scam or trap to swindled fund from victims.  And the easiest way to scam people in telegram is by sendind a virus in form of a bot guiding you connect your wallet maybe internal telegram Wallet or external wallet and when this is connected anything can happen.  Because access has been granted, It is important people don't  connect  their external wallets with Hodling, to the telegram airdrop connect, to avoid swindled of fund or to avoid malwear or clipboard virus.