Malvertising Used to Lure Victims into Downloading Malware
Note: We are reader supported and may earn a small commission when you click on links in posts
A Spyware attack uses three spoofed Telegram app websites to lure victims into clicking on a link that downloads a windows executable file. The three websites impersonate the legitimate Telegram messaging app website.
Most of the links on the impostor sites lead back to the legitimate telegram site. However one of them launches a malware download instead.
The cybercriminals behind the malware attack used Google Ads in a malvertising campaign to lure in victims.
What is Telegram?
Telegram is a messaging app for Android, iPhone, Mac, and Linux users. It also has a desktop client which is what was spoofed in this campaign. Telegram messaging app lets users send text messages and make voice and video calls securely. Users can also send images and media.
Telegram is one of many messaging apps that offers end-to-end encryption to ensure the privacy of messages and media sent between users.
The number of downloads of Telegram and private messaging app Signal skyrocketed in January of this year. Facebook’s WhatsApp announced a massive change to its privacy policy which caused users to flee to secure alternatives.
READ New Credit Card Skimming Attack Leverages Telegram
Fake Telegram Desktop Clients
Three websites, telegramdesktop[dot]net, telegramdesktop[dot]com, and telegramdesktop[dot]org, are all designed to look like a desktop version of the Telegram messaging app. Only telegramdesktop[dot]com triggers a warning from Google’s Safe Browsing tool.
The malware is hosted on Bitbucket and the domain names were registered at namecheap.com. All three websites have a security certificate.
“When accessing the repo we can gather some information about infections, dates of the operation as well as other malware samples,’ says Suid Vulnerability Research. According to Suid, who discovered the malware, the sites have tricked over 3,00 visitors into downloading the malicious executable file.
How to Stop Spyware
The impostor websites were designed to look exactly like telegram a legitimate messaging app. most of the links on the fake websites we’re harmless. however, one link would instantly download spyware to your computer or device.
READ Classiscam Telegram Phishing Scam Targeting Europeans
App users should always scrutinized websites they used to download apps or other software.
Use a reliable security app on all of your devices to detect malicious websites, phishing emails. Security apps can intercept harmful links before the damage is done.
