Telegram Snipers and Phishing Groups — How Scammers Target Darknet Users on Messaging Apps

How Telegram Snipers and Phishing Groups Operate on Darknet Markets

The darknet ecosystem has always been a cat-and-mouse game, but the latest evolution of threat vectors targeting users isn’t happening on .onion sites themselves. It’s unfolding on Telegram channels, Discord servers, and through sophisticated social engineering campaigns that exploit the very tools privacy-conscious users rely on for communication. This article examines how phishing groups, automated “sniper” bots, and impersonation scams are systematically draining wallets and compromising accounts – and what the data tells us about these operations.

The Anatomy of a Telegram Sniper Operation

Telegram has become the preferred coordination platform for both market vendors and scammers. Groups advertising “sniper” services – automated bots that monitor blockchain transactions and execute trades or claim airdrops faster than humans – are increasingly common. But many of these groups are themselves phishing operations. The modus operandi is straightforward: a user joins a channel promising early access to a token sale or marketplace listing. The admin sends a link to a “verification bot” that asks for your wallet seed phrase or private key. This is a variation of the classic advance-fee scam, repackaged for the Telegram audience.

What makes these attacks dangerous is their use of legitimate-looking infrastructure. As noted in research on the UNC6692 threat group, attackers exploit trust in familiar collaboration tools to walk victims through handing over control of their machine [3]. Similarly, Telegram snipers often create channels with thousands of members (many of them bots), fake testimonials, and real-time fake trade notifications to build credibility. The attacker poses as a helpful admin, just as UNC6692 posed as IT helpdesk staff, exploiting the target’s trust in the platform itself.

The scale of these operations is significant. A single Telegram channel tracked by researchers at one cybersecurity firm was found to have siphoned over $2 million in cryptocurrency over six months through fake giveaway and “sniper bot” schemes. The funds are then laundered through mixers and decentralized exchanges. This is not amateur hour – these groups often employ automated scripts that process withdrawal requests instantly, creating the illusion of legitimacy while they slowly drain larger deposits.

Phishing Groups That Target Darknet Market Users Specifically

For darknet market participants, the threat is even more acute. Telegram groups that claim to offer “verified market links,” “escrow services,” or “vendor verification” are often fronts. The scam works because the user cannot memorize a 56-character .onion address – a legitimate URL might look like expyuz5tat...3ad.onion while a phishing version substitutes one character: expyuz5tbt...3ad.onion [1]. Humans cannot distinguish these at a glance, so they rely on directories, forums, or Telegram channels to get the correct link.

Threat actors flood dark web search engines and Reddit forums with fake links [1]. When a user enters their username, password, or Bitcoin PIN into the fake site, it is gone forever. The darknet community’s answer has been PGP-verified directories like Dark.Fail and Tor.Taxi, which maintain direct contact with marketplace administrators and update links when markets change their .onion addresses to avoid DDoS attacks [1]. However, Dark.Fail is frequently targeted by extortion and DDoS attacks itself, meaning the directory is often offline when users need it most [1]. This creates a vacuum that Telegram snipers fill – but the Telegram “helpers” are often the attackers.

A particularly insidious variant involves groups that claim to offer “sniper bots” for limited-time marketplace listings or vendor drops. They require you to deposit funds into a “smart contract” or provide your Monero wallet’s view key. Once you do, the bot disappears with your deposit. These groups often have fake positive reviews posted by sock-puppet accounts, and they use hidden HTML or structured data to make their Telegram channels appear more authoritative to search engines [5]. This technique – SEO poisoning combined with hidden JSON-LD instructions – has been documented in campaigns targeting cryptocurrency users [5].

How Phishing Groups Weaponize SMS and 2FA Vulnerabilities

Even if a user avoids direct Telegram scams, they remain vulnerable to credential theft through SMS interception. SMS 2FA – still widely used by cryptocurrency exchanges and even some marketplaces – is fundamentally insecure due to three attack vectors that are actively exploited by Telegram-linked phishing groups.

The first is SIM swapping. A hacker calls your mobile carrier, claims to be you, and convinces the representative to transfer your phone number to their SIM card. Your phone instantly loses service. Meanwhile, the hacker’s device receives your SMS 2FA codes, draining your accounts before you even realize your phone went dead [7]. This attack works even if you have “extreme security pins” set with your provider, because the SS7 network itself is flawed. Text messages are routed through Signaling System No. 7, a protocol built in the 1970s that assumes every connected entity is a trusted telecom operator. Sophisticated threat actors exploit SS7 vulnerabilities to silently intercept SMS messages while they are in transit – you still have service on your phone, but the hacker receives a carbon copy of your 2FA code [7].

The second vector is man-in-the-middle phishing using tools like Evilginx. A hacker sends you a link that looks exactly like your exchange login page. You type in your username and password; the fake site prompts for your 6-digit SMS code. The real exchange texts you that code, and you naively type it into the hacker’s fake site. Because the hacker’s automated script acts as a proxy, it instantly submits your code to the real exchange and bypasses 2FA in real-time [4][7]. Telegram groups specializing in this often use domains that typosquat legitimate services – for instance, registering debank-login.com instead of the real DeBank domain, stuffing the fake site with SEO terms like “Crypto Tracker” and “DeBank Login” [5].

The third and most alarming vector is the use of custom-built phishing frameworks that combine multiple techniques. The UNC6692 group, for example, begins with a wave of spam emails to create urgency, then reaches out via Microsoft Teams posing as IT support offering to fix the problem they caused [3]. This staged setup convinces users to trust a stranger who appears to be solving an issue. When the victim accepts the fake Teams invitation, the attacker sends a link claiming to install a patch. Clicking it downloads a renamed AutoHotkey binary and a script from an attacker-controlled cloud bucket, deploying the SNOW malware ecosystem [3]. This modular toolkit includes a malicious browser extension, a Python-based tunneling tool, and a local backdoor – each handling a different part of the intrusion [3].

We see similar approaches in Telegram-based attacks: attackers first spam a user’s inbox or Telegram DMs with fake alerts, then offer to “help” through a supposedly official Telegram channel. The trust manipulation is identical, only the platform changes.

The Economics: How Much Money Are These Groups Making?

Quantifying the total losses is difficult because many victims do not report, and Telegram scams often fly under law enforcement radar. However, we have concrete data points. In one recent case, the DOJ seized $8.2 million tied to pig butchering schemes – a type of long-term financial grooming scam [2]. The complaint noted that the scammer-controlled addresses contained commingled funds from numerous known and unknown victims [2]. The DOJ used a dual legal theory: funds directly traceable to fraud were forfeited under wire fraud statutes, while remaining funds likely tied to additional victims were seized as property involved in money laundering [2]. This allowed the FBI to freeze the full amount, which is now being traced backwards to identify other victims [2].

Telegram-based phishing groups often use similar laundering patterns. They commingle funds from multiple victims through mixers and decentralized exchanges, making tracing difficult. The scale is substantial: a single Telegram phishing ring tracked by blockchain analysis firms was responsible for at least $15 million in losses in 2025, with victims primarily from Eastern Europe and Southeast Asia.

One particularly lucrative operation is the “hacking-for-hire” service Darkhub, which advertises on the Tor network and targets both individuals and organizations [6]. Its services include unauthorized access to Telegram and WhatsApp accounts, email compromise, mobile phone monitoring, and real-time location tracking [6]. Darkhub also offers cryptocurrency-related fraud services and, notably, “fund recovery” – a classic advance-fee scam that preys on prior fraud victims by promising to recover lost money in exchange for an upfront payment that is never returned [6].

Researchers at Oasis Security found that Darkhub’s backend is partially exposed beyond the Tor network – a publicly accessible IP address was linked to the service [6]. This is a critical OPSEC failure for a platform that depends on staying hidden, but it also illustrates that these operations are not as sophisticated as they appear. Many Telegram phishing groups make similar mistakes: using unencrypted Telegram channels, reusing wallet addresses, or hosting phishing sites on cloud providers without proper anonymization.

Defensive Measures for Users

The bottom line is that SMS 2FA should be removed entirely from your security posture. Relying on text messages to secure sensitive digital assets is a critical OPSEC failure [4]. Your phone number was designed for communication, not cryptography. It is tied to a highly vulnerable global network and managed by fallible customer service agents [4]. Upgrade to cryptographic 2FA methods that generate codes offline – TOTP apps like Authy or Aegis, or hardware tokens like YubiKey [4]. For cryptocurrency wallets, use hardware wallets with passphrase protection.

For darknet market users specifically: never trust a .onion link from a Telegram channel, no matter how many members the channel has or how polished it looks. Verify all links against PGP-signed directories like Dark.Fail or Tor.Taxi [1]. If Dark.Fail is offline due to DDoS attacks – which is common – wait until it returns, or cross-reference links from multiple independent sources. Treat any Telegram bot that asks for your private key or seed phrase as malicious. There is no legitimate reason for any service to request your private keys.

Finally, be skeptical of “sniper bots” or “early access” services. The majority are advance-fee scams. If it sounds too good to be true, it is almost certainly a phishing operation designed to drain your wallet. The UNC6692 playbook shows that attackers are willing to invest in multi-stage social engineering campaigns that span multiple platforms [3]. On Telegram, the same pattern applies: spam, then impersonation, then compromise. The only effective defense is to assume every unsolicited message is hostile and to verify every link through independently confirmed, PGP-signed channels. This article is for research and educational purposes only – always exercise extreme caution when interacting with any platform that handles your cryptocurrency or personal data.