AI-Assisted Phishing Campaign Harvesting Victim Data

Executive Summary — Cyble Research & Intelligence Labs identified an active, scalable phishing campaign hosted on edgeone.app that social-engineers victims into granting camera, microphone, and contact permissions; client-side JavaScript then captures images, video, audio, device telemetry, and location and exfiltrates these artifacts via the Telegram Bot API. The report details the attack chain, targeted brands and lures, indicators of potential AI-assisted code generation, business impacts (identity fraud, KYC bypass, extortion, targeted social engineering), and recommended mitigations such as restricting camera permissions, monitoring traffic to api.telegram.org, deploying browser security controls, and domain monitoring.