Saturday, December 2, 2023

Telegram Increasingly Abused For Selling Stolen Financial Details

The cybercriminals are actively abusing the Telegram messenger for setting up underground channels and selling stolen financial details on them and also executing their other illicit activities as well.

Why are threat actors abusing Telegram instant messaging service? 

They did so due to its features and user base, as Telegram has an active user base of more than 500 million, and not only it also offers end-to-end encryption communication to its users.

While apart from this, here we have mentioned other six key reasons due to which the threat actors find Telegram as one of the most lucrative selection to promote their malicious activities:-

  • The approach of loose moderation.
  • Only censoring extremist content.
  • Easier to set up a Telegram channel.
  • Easier to promote and draw a wider audience.
  • Telegram channels are more volatile and short-lived.
  • Telegram channels are harder to track.

An Abiding Trouble

In a recently published report, the cyber security experts at Cybersixgill have justified the data that they have collected throughout the following years:- 

  • 2020
  • 2021

As they have claimed there is a tremendous drop in the sale volume of financial accounts in Telegram, but, it doesn’t mean that it’s an end, so, it still remains a stable issue.

During the analysis, the bot spam was filtered and mainly targeted the focus on the high-quality data in which several keywords were identified that are related to:-

  • Financial account sales.
  • Money laundering.

Here, as compared to the report of 2020 the stark nosedive of 60% is the prevailing reduction of newly-issued credit cards that are issued during the pandemic.

Here’s what Cybersixgill’s analysts stated:-

“This stark nosedive in the discourse surrounding compromised accounts from 2020 to 2021 might seem remarkable, but it is not an isolated event; a parallel decrease was also identified in the total number of compromised credit cards sold on underground markets throughout the same period.”

Moreover, among all the mediums the threat actors have actively abused the services of PayPal that is followed by Chase and Western Union, as in the graph below you can see.

The attackers targeted and abused PayPal most due to its two key features:-

  • The direct way to drain funds from other people.
  • Easy to make online purchases.

Most of the compromised accounts were used by the buyers for purchasing cryptocurrencies, and they are hard-to-trace which makes the execution of money laundering easier for the threat actors.

Credit Cards and Bank Logs

On Telegram channels at a smaller volume, credit cards are also offered by the threat actors. And price range varies between $10 to $1,500 for a single card, all these depend on the following points:-

  • Bank account balance.
  • The freshness of the data. 

All the stolen and compromised cards that are sold belong to the following services mainly:-

  • Chase Bank
  • Bank of America
  • Wells Fargo
  • Western Union
  • Visa
  • Mastercard

While apart from this, along with stolen credit cards, the attackers also sell compromised dank credentials, which are termed as “Logs” on the dark web.

On Telegram channels, all these are just a tiny part of the activities executed by the threat actors since Telegram offers several easy-to-use features and hard-to-trace anonymity which make this platform more vicious.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles