---
title: "Protection Highlight: Phishers Ramp Up Exploitation of Telegram Bot API"
url: https://www.broadcom.com/support/security-center/protection-bulletin/protection-highlight-phishers-ramp-up-exploitation-of-telegram-bot-api
description: "Protection Highlight: Phishers Ramp Up Exploitation of Telegram Bot API"
---

# Protection Highlight: Phishers Ramp Up Exploitation of Telegram Bot API

**Protection Highlight**  
June 11, 2024

**Telegram Service**  
Telegram is a cloud-based messaging service known for its secure, private communication features including encrypted chats and self-destructing messages. It supports large-scale groups, channels for broadcasts, and extensive media/file sharing. The service has hundreds of millions of active users worldwide.

**Abuse On The Rise**  
Over the past few months, more and more phishing actors via malicious HTML have been following in the footsteps of Infostealers and RATs, and are now also abusing the Telegram Bot API to harvest users' credentials and other sensitive information such as credit card details. Activities are being observed worldwide and these can cause significant financial losses, operational disruptions, and reputational damage for enterprises. Attackers use stolen credentials for account takeovers, identity/financial theft, and additional attacks, often selling stolen data on the dark web.

The uptick is driven by several key factors. From a threat actor’s perspective, the ease of use and anonymity offered by Telegram make it an attractive option. The Telegram Bot API is straightforward, requiring minimal coding skills, and provides an efficient and scalable way to handle large volumes of stolen data. The real-time nature of Telegram allows attackers to receive credentials and other sensitive information instantly, enabling quick action before victims can respond (e.g., change passwords, inform their IT department, etc.). In addition, shifting away from traditional methods of phishing exfiltration to newer techniques can provide a temporary evasion from existing types of monitoring and protections.

**Attack Workflow**  
1. The process typically starts with the attacker creating a Telegram bot, obtaining an API token that allows the bot to communicate with Telegram servers. Next, the attacker sets up a Telegram channel, either public or private, where the bot will send the stolen credentials.
2. A phishing email sent to victims contains an HTML file, most of which are disguised as legitimate office documents (PDF, Excel, Word, etc.). When opened, these files display a fake login page that mimics the appearance of a secure document login screen. Users are prompted to enter their credentials to "view" the document, but instead of accessing any real document, the entered credentials are sent directly to the attackers.
3. Captured credentials are then sent to the Telegram bot using the Telegram Bot API. The JavaScript code in the HTML file sends an HTTP GET or POST request to the Telegram Bot API with the stolen credentials. The script prevents the form from submitting in the traditional way, collects the username and password, and sends this information to a specified Telegram channel via the bot.
4. Finally, once the credentials are sent to the bot, they are posted in the Telegram channel. The attacker can monitor this channel in real-time to collect the stolen information. This method allows phishers to efficiently and anonymously collect credentials with minimal effort.

A typical fake document, here soliciting the user's password

Observed malicious HTMLs exhibit varying levels of obfuscation and incorporate different scripting techniques. The chart below captures the recent attack trend.

Staying on top of the evolving threat landscape demands 24x7 monitoring, continuous innovation, adaptive security strategies, and threat intelligence sharing across technologies. Symantec incorporates all these things and more to facilitate a robust defense against threats such as the one described in this bulletin, ensuring comprehensive protection and ultimately peace of mind.

Symantec protects you from this threat, identified by the following:

**Email-based**  
- Protection is in place for Symantec's email security products. Email Threat Isolation (ETI) technology from Symantec provides an extra layer of protection.

**File-based**  
- Phish.Html*  
- Phish.TGhtml  
- Scr.Phish!gen7  

Click [here](https://www.broadcom.com/products/cybersecurity/email/security-cloud) to learn more about Symantec's Cloud Email Security Service.

Click [here](https://www.broadcom.com/products/cybersecurity/endpoint) to learn more about Symantec's Endpoint Security Service.