Telegram exfiltration
Telegram exfiltration is the practice of phishing kits sending stolen passwords, card numbers or seed phrases straight to the operator through a Telegram bot.
How it works
The kit contains a bot token and a chat ID; each submitted form triggers a sendMessage call to the Telegram Bot API, often from the victim's own browser.
The token in the page source lets investigators identify the bot and report it, and sometimes see how many victims were affected.
How to protect yourself
- Analysts should search phishing pages for api.telegram.org calls and bot tokens, and report bots to Telegram.
- Victims should assume any data typed into such a page is already with the operator.