A security researcher at CyberArk received an SMS phishing message posing as the Israeli credit card company Isracard. As expected, the researcher started to track down the origin of the attack. Based on an insecure server configuration he was able to infiltrate the Telegram channels for the phishing campaign. An open directory on the phishing site served the complete kit as a ZIP archive, and its config.php held the Telegram bot token that revealed every group and user subscribed to the bot. Two of those channels were open to anyone and even shared the login for the VPS that hosted the group’s kits for several countries. Operational security, it seems, was not part of the subscription. Telegram is a popular exfiltration channel anyway: Cofense reported a year-over-year increase of more than 800% between 2021 and 2022 in phishing that sends stolen data to Telegram bots. The whole story is described here, including how the researchers rebuilt a campaign with the kit in about ten minutes.
