F6 company has identified a new scam scheme on Telegram targeting Russian users. Attackers lure people into a chain of fake channels and bots through alarming topics: false alerts about UAV attacks, "confiscated car sales," or channels that allegedly work "even without mobile communication."
The scheme is built on several transitions. The user is offered to subscribe to "their city's channel," "the country's main news channel," or another resource, after which they end up in another bot. F6 believes that this way, scammers can gather an audience for "sleeping" bots: after days, weeks, or months, they change their name and start sending phishing links, malicious files, or new deceptive offers.
One of the final scenarios is related to a fake payment on behalf of the "Rabota Rossii" portal. The bot promises 4000 rubles for 15 minutes of a "mini-survey," and then redirects the user to a page with "verified tasks" and earnings "remotely and without experience." After several clicks, the amount suddenly increases to 300 thousand rubles, and to receive the money, they are offered to write to a "manager" on Telegram.
Further, the scheme becomes classic: the victim is promised a large payout, but under various pretexts, they are first asked to pay themselves - for commission, confirmation, transfer, or processing. As a result, the person does not receive money but loses their own. Similar risks exist in fake marketplace giveaways, where a "prize" requires paying a commission and can extort card or passport data.
F6 also warns about channels with names like "Radar" and indicating a city or region. Links to them are spread through open house and district chats, especially amidst discussions of drone attacks. Experts advise not to click on links from strangers, not to subscribe to channels from unverified sources, and not to launch Telegram bots via such links.