Telegram phishing campaign targeted exiled Belarusian activist, Russians and Kazakhstanis

Resident NGO reported a sophisticated, targeted Telegram phishing campaign (active since at least October 2024) that sent fake security-alert messages via secret chats to specific users — primarily Belarusian activists and users in Russia and Kazakhstan — using individualized links embedding recipients' phone numbers to capture Telegram one-time login codes. The operators fingerprinted visitors' browsers/devices to display the fake login only to intended targets, redirected security tools and other visitors to benign pages to evade detection, tracked who opened links (collecting device, time, ISP), and obfuscated text with lookalike characters; researchers found 64 distinct phone numbers in links but could not confirm any successful account compromises or determine the campaign's ultimate goal.