"You'll like it" is a phrase that you should be wary of in Telegram.
Cybercriminals started hacking Telegram accounts using thematic sites with images, analysts of the Solar Group of companies said.
Employees of the Solar AURA external digital threat monitoring center found more than 300 resources created to steal Telegram profiles. On such sites, attackers place attractive images that users can find in the search results.
When clicking on a link to an image, the user is redirected to a phishing resource that mimics the Telegram page. Most of them have names like "You'll like it." When you try to join the community, the user gets to a page with a QR code or a form for entering the username and password from their messenger account. If the data is entered, it will automatically get to the scammers. Enabled two-factor authentication is not an obstacle for intruders.
According to Solar, this massive campaign was launched in December 2023. Hackers created a network of similar sites "with hundreds of thousands of images" and descriptions to them. Images on each resource are grouped by subject - experts found sites about anime, doramas, fan fiction, memes, and even pizza. All detected resources were blocked.
"To date, this is the most massive and sophisticated campaign aimed at hacking Telegram accounts," the company said.
Cybercriminals started hacking Telegram accounts using thematic sites with images, analysts of the Solar Group of companies said.
Employees of the Solar AURA external digital threat monitoring center found more than 300 resources created to steal Telegram profiles. On such sites, attackers place attractive images that users can find in the search results.
When clicking on a link to an image, the user is redirected to a phishing resource that mimics the Telegram page. Most of them have names like "You'll like it." When you try to join the community, the user gets to a page with a QR code or a form for entering the username and password from their messenger account. If the data is entered, it will automatically get to the scammers. Enabled two-factor authentication is not an obstacle for intruders.
According to Solar, this massive campaign was launched in December 2023. Hackers created a network of similar sites "with hundreds of thousands of images" and descriptions to them. Images on each resource are grouped by subject - experts found sites about anime, doramas, fan fiction, memes, and even pizza. All detected resources were blocked.
"To date, this is the most massive and sophisticated campaign aimed at hacking Telegram accounts," the company said.
