Threat Update: Telegram's Telegraph Service used for Scams

Telegram's Telegraph Service used for Scams

Alpha Team has observed a new tactic being used by Bitcoin "giveaway" scammers on social and digital platforms. Scammers are using YouTube "live" channels, with fake views and chat bots, to drive traffic to giveaway sites. These sites use Telegram's Telegraph service, which is a lightweight web page similar to Medium, that can be quickly recycled under the Telegraph service.

Recommendations

• Enable Impersonation protection for executives or influencers in your company to find scammers using their likeness

Details

Cryptocurrency giveaway scams are similar to money-flipping scams. The basic premise is that scammers will advertise a giveaway of cryptocurrency, usually impersonating an influencer in the cryptocurrency community or a celebrity, and the only way to enter the giveaway is to send the scammers money for a larger return.

These scams have been documented by a number of news and media outlets, as Alpha Team has been tracking these scams for close to 2 years. A recent article on Bitcoin.com outlined a Youtube scam with Elon Musk and 'live' channels advertising these attacks.

Figure 1: SpaceX Live Channels from Bitcoin.com article

Since 2018, scammers have adapted their TTPs to avoid detection. This includes using unicode characters in their tweet replies, which look like Latin characters to a human but are different interpretations of character codepoints to a computer. Then, scam text was embedded in a picture, where there was no text in posts advertising the scams. Migrating to Youtube where these scammers can abuse impersonation profiles, chat functionality and overlaying scam text in a streaming video make it harder for detection for the platforms.

Figure 2: Searching Youtube for Elon Musk and filtering by Live

Many of these sites embed a QR code for people to directly scan from their phone to send Bitcoin. These QR codes typically link to a landing site with a crypto wallet address as well as additional text explaining the giveaway. This is an efficient pretext as it attempts to increase legitimacy for the opportunity.

Figure 3: QR Code embedded over a pre-recorded video for the Giveaway

Figure 4: Landing site on Telegram's Telegraph Service for the Scam

Figure 4 shows a landing page on Telegram's Telegraph service. This service is an anonymous blogging platform, similar to Medium, that is maintained by Telegram. Scammers typically used other blog services, such as Blogspot or Medium, to host these scam pages, but they required an account. With Telegraph, scammers can quickly setup a page, so when one gets blacklisted, they can move to another.

Alpha Team performed a search on URLScan for any websites being submitted for the Telegraph service and downselected the results based on terms such as giveaway, bitcoin or influencer names. There has been a significant increase in sites being submitted to URLScan using the Telegraph service, indicating that scammers are moving infrastructure to this anonymous microblogging platform.

Figure 5: Telegraph submission in URLScan in the last 2 years

Based on the number of Youtube-live scams, the relative success of some of these wallet addresses, and the increase in Telegraph based scam landing pages, Alpha Team has HIGH confidence that this will continue to plague Youtube and the cryptocurrency community.