Scammers are now hiding phishing pages inside Telegram by leveraging its built-in Mini Apps and WebView mode. After the messenger's update on August 25, attackers can disguise fraudulent sites as games, polls, giveaways, or banking interfaces that appear native to the application.
Users encounter familiar buttons and clean windows that prompt them to confirm transfers, claim bonuses, or participate in votes. Instead of receiving rewards, victims may hand over account credentials, connect cryptocurrency wallets, or approve malicious transactions. In voting schemes, targets are asked to provide phone numbers and confirmation codes under the pretext of preventing vote manipulation, enabling account takeovers.
Cryptocurrency lures often involve fake airdrops or balance checks that require connecting a wallet to an unknown service. Another technique mirrors the ClickFix method: the app reports an error, copies a command to the clipboard, and instructs the user to paste it into PowerShell. Because the victim performs the harmful action manually, traditional antivirus solutions may not detect the activity.
Opening a message or Mini App alone does not automatically steal funds. Attackers must still convince the target to authorize access, enter codes, install software, or confirm operations. Social engineering remains the primary tool rather than any automated exploit.
Security researchers recommend launching Telegram Mini Apps only from verified sources, avoiding entry of verification codes in polls, and never connecting payment cards or crypto wallets for questionable promotions.
