Telegram Phishing Campaign Hijacks Accounts by Abusing Trust

CYFIRMA reports a large-scale phishing campaign that abuses Telegram's legitimate authorization prompts to perform account takeovers: victims visiting spoofed sites are coached to scan QR codes or enter phone numbers, which trigger real in-app authorization requests on their devices. The attackers use a configuration-driven, multilingual framework that supports rapid domain rotation and mass deployment, enabling persistent, high-volume operations that bypass traditional credential-harvesting defenses.