Cybersecurity researchers from ESET recently discovered a new toolkit that allows even the lowest-skilled hackers to pull off elaborate phishing schemes. The toolkit is called Telekopye and it’s implemented as a Telegram bot. Hackers can use it to generate fraudulent websites and landing pages, send SMS messages and emails, and create fake screenshots.
The targets are mainly online markets popular in Russia, such as OLX and YULA. However, ESET’s researchers also saw hackers targeting marketplaces native to other countries, such as BlaBlaCar, and eBay. In some instances, victims had nothing in common with Russia, such as Jófogás and Sbazar.
There are three ways criminals can use Telekopye – to scam buyers (twice) and to scam sellers. When it comes to scamming buyers, the attackers create a fake purchase site and navigate the victims there, to pay online. The site harvests sensitive information such as online banking logins, credit card details (sometimes even account balances), and more.
“Rats” everywhere
Hackers can also scam people looking for refunds in the same manner – by sending a link to a phishing site. Victims would think they were applying for a refund when in reality they were getting their data stolen.
Finally, when scamming sellers, the hackers would reach out to the company, claiming they had already paid for the item and that they were now looking for a refund. The victim seller would then get a link “proving” the purchase, which would then be used to siphon out sensitive data.
The tool is still being developed and improved upon, ESET added. The developers promoting it in various places, including underground forums, and they’re straightforward in their ads – the tool is used to scam online marketplace users.
They’re also aware that the group is full of “rats” (law enforcement) and encourage users to be quiet and work. Any inquiries into any information that could identify other members of the group result in a ban.
