The Criminal Threat Prediction Centre of the Committee for Legal Statistics and Special Records of the Prosecutor General's Office has warned users about a new scheme for hacking Telegram accounts. Attackers are sending messages allegedly from the messenger's official support service, convincing users to urgently cancel a non-existent deletion of their account.
HOW THE SCHEME WORKS
According to the press service of the Prosecutor General's Office, information about the new scheme is based on reports from foreign sources. Users receive fake notifications stating that a request has supposedly been made to delete their account.
The message asks users to press a special button within 24 hours to cancel the deletion. Users are warned that after the deadline, their chats, contacts, and files will be permanently deleted.
WHAT THE ATTACKERS ARE COUNTING ON
The scheme is built on psychological pressure. The attackers try to instil fear in the user of losing access to their account, forcing them to act hastily.
After clicking the link, the user is taken to a Telegram bot or a fake website, where they are asked to enter a confirmation code from an SMS or messenger notification. It is emphasised that there is no such procedure as cancelling an account deletion.
By entering the code, the user effectively hands over access to their account to third parties.
WHAT ARE THE POSSIBLE CONSEQUENCES
Once they gain control of the account, attackers can read correspondence, access personal data, send messages on behalf of the owner, and contact their acquaintances requesting money transfers. The account may also be used for further fraudulent attacks.
HOW TO SPOT A SUSPICIOUS MESSAGE
The main signs of such messages include:
- the sender is impersonating support but has no verified status;
- the user is urged to urgently click a link or use a bot;
- the message asks for a confirmation code from an SMS or Telegram;
- a sense of urgency and threat of losing the account is created;
- the sender's account was created recently, has changed its name, or shows other suspicious signs;
- the text contains unusual phrasing, errors, or dubious links.
WHAT MEASURES DO EXPERTS RECOMMEND
The Prosecutor General's Office advises not to share confirmation codes and passwords with strangers, not to click on suspicious links, and not to enter Telegram details on third-party websites or bots.
Users are also recommended to enable two-step verification, regularly check active sessions in the 'Devices' section, terminate unknown connections, and only obtain information through the messenger's official settings and channels.
Experts note that attackers rely on the user's haste and fear. Taking a few minutes to verify information can help prevent the loss of an account and the associated risks.