PhishingPublished 8 Dec 2025

type osint · Telegram phishing and related activities

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

Telegram phishing and related activities

Impact

For European organizations, the impact of Telegram-based phishing can be significant, particularly for those relying on Telegram for internal communication, customer support, or marketing. Successful phishing attacks can lead to credential compromise, enabling attackers to access corporate networks, exfiltrate sensitive data, or conduct further attacks such as business email compromise or ransomware deployment. The confidentiality of user and organizational data is primarily at risk, with potential secondary impacts on data integrity and system availability if attackers leverage stolen credentials to escalate privileges or disrupt operations. Sectors with high digital engagement, such as finance, technology, and government, are particularly vulnerable. Additionally, the use of Telegram in some European countries is substantial, increasing the attack surface. The threat also poses reputational risks if customers or partners are targeted via phishing campaigns impersonating the organization. Given the social engineering basis, the impact depends heavily on user awareness and the effectiveness of security controls in place.

Defensive guidance

To mitigate Telegram phishing threats, European organizations should implement targeted user education programs emphasizing the risks of unsolicited messages and the importance of verifying sender identities on Telegram. Security teams should monitor Telegram channels and groups relevant to their industry for phishing indicators and report suspicious activity to platform administrators. Enforcing multi-factor authentication (MFA) across all critical systems can reduce the risk of account compromise even if credentials are stolen. Organizations should establish clear policies regarding the use of Telegram for official communications and encourage the use of secure, verified channels. Deploying email and messaging security solutions that can detect and block phishing links or malicious content shared via Telegram is also advisable. Incident response plans should include procedures for handling phishing incidents originating from messaging platforms. Finally, collaboration with national cybersecurity centers and sharing threat intelligence related to Telegram phishing can enhance collective defense.

Indicators of compromise

Domains 24

tellandgram.ru
web.tellandgram.ru
web.telegpam.ru
telegpam.ru
account.telegpam.ru
org.loginemail.ru
telegam.org.loginemail.ru
web.telegam.org.loginemail.ru
loginemail.ru
account.loginemail.ru

IP addresses 1

178.20.41.242: enriched via the circl_passivedns module.

178.20.41.242

Counter 3

Text 20

https://www.circl.lu/pdns/
A
178.20.41.242
web.telegra.org.idloginmail.ru
https://www.circl.lu/pdns/
A
178.20.41.242
web.telegra.org.idloginmail.ru
https://www.circl.lu/pdns/
A

Datetime 6

2025-11-27T06:00:40+00:00
2025-11-27T06:00:40+00:00
2025-11-27T06:00:40+00:00
2025-11-27T06:00:40+00:00
2025-11-27T06:00:40+00:00
2025-11-27T06:00:40+00:00

Float 4

Community reviews

Loading reviews…