Threat Actors Exploit Telegram as the Communication Channel to Exfiltrate Stolen Data

tLab Technologies, a Kazakhstan-based company that specializes in advanced threat prevention, discovered one of the first known phishing attempts in the region that targeted public sector clients in a recent cybersecurity incident.

The attack leveraged a professionally crafted fake login page to harvest user credentials, employing Telegram’s Bot API as a covert exfiltration channel.

This method, while not entirely novel, demonstrated a high level of sophistication in mimicking legitimate government interfaces, making it particularly deceptive for unsuspecting users.

The campaign exploited user trust through social engineering tactics, such as pre-filled email fields and fake security notices, to facilitate credential theft.

tLab’s Anti-APT system played a pivotal role in detection, utilizing a unique blend of heuristic analysis, optical character recognition (OCR) for rendered content extraction, and automated behavioral monitoring to identify the malicious HTML without manual intervention.

This allowed for rapid verdict generation within 60 seconds highlighting the system’s efficacy against zero-day threats and advanced persistent threats (APTs).

Technical Breakdown of the Attack Mechanism

The phishing operation begins with a malicious HTML file that renders a counterfeit login form, visually identical to official Kazakhstan government portals like those under ..gov.kz domains.

Embedded JavaScript intercepts form submissions, capturing entered usernames and passwords without triggering standard server-side processing.

The script then constructs a formatted message simulating stolen credential logs and transmits it via a GET request to the Telegram Bot API, enabling real-time data exfiltration to an attacker-controlled chat.

In one analyzed sample, the page displayed a pre-filled government email (e.g., @.***.gov.kz) and prompted users to “Confirm your mailbox to access the file,” accompanied by a deceptive note claiming protection by the official security system.

This user interface deception enhances plausibility, exploiting psychological vulnerabilities. A secondary sample, titled “Specification” (SHA-256: 7ee39d2572f161d4c94bb06bda5bea229d39dc869808ad5f5d110964aa470071), employed a table-based layout with blurred backgrounds and base64-encoded images for obfuscation.

Upon credential entry, it posted data to a third-party form submission service before redirecting to a legitimate Microsoft support page, masking the attack’s success.

Both instances aligned with the Cyber Kill Chain: from targeted reconnaissance and weaponization of HTML payloads, through phishing email delivery and trust exploitation, to C2 via Telegram and objective fulfillment via account compromise.

tLab’s sandbox analysis captured screenshots of dynamic page changes, revealing static phishing behaviors that evaded traditional antivirus by avoiding executable code execution.

Defensive Strategies

This campaign underscores the evolving threat landscape, where adversaries repurpose legitimate platforms like Telegram and Firebase for malicious ends, bypassing conventional network defenses.

By integrating deep behavioral analysis and API token detection, tLab’s tools automatically flagged over 100 malicious activities, processing up to 10,000 samples daily on a single server.

According to the report, Organizations, especially in government and critical infrastructure sectors, must prioritize multi-layered defenses, including employee training on phishing indicators, implementation of web application firewalls, and real-time monitoring for anomalous API calls.

Continuous threat intelligence sharing, as demonstrated by tLab’s alliances with firms like Trend Micro, is crucial for preempting such attacks.

Ultimately, this incident highlights the need for proactive vulnerability assessments to counter data exfiltration tactics that blend technical prowess with social engineering.

Indicators of Compromise (IoCs)

Category	Indicator
File Hash	7ee39d2572f161d4c94bb06bda5bea229d39dc869808ad5f5d110964aa470071 (SHA-256)
Telegram Token	7527440371:AAGIaR_ObbDwitbGuKLl4bH_qMt6TnGpuTY
Telegram Chat ID	6516482987
Network Endpoint	submit-form.com/On59mco96 (credential collection)
Redirect URL	support.microsoft.com/EN-EN/onedrive (post-exfiltration)

AWS Security Services: 10-Point Executive Checklist - Download for Free