# MA-976.102023: MyCERT Alert - Telegram Phishing Impersonate MyKasih Sumbangan Asas Rahmah (SARA)

**Date:** 20 Oct 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-976.102023  
**Advisory ID:** MA-976.102023

---

**1.0 Introduction**
MyCERT observed lately that cybercriminals are using a phishing website that closely mimics an eWallet service login page in Malaysia, targeting Telegram users with the purpose of taking over users’ Telegram accounts for malicious purposes.
The concerned phishing website 
Figure 1: Phishing site page prompting for the victims’ phone number
The modus operandi used by the Threat Actor is shown below:
1) A potential victim will receive a message in his/her Telegram account.
2) In the message, the victim is lured into clicking a phishing website, seemingly unsuspecting to victims, at :(hXXps[:]//s[.]id/BantuanAsasRahmaRakyatMalaysia). This phishing website is currently shared across messaging groups via Telegram.
3) Once clicked, the victim will be redirected to the actual phishing site, unsuspicious to the victim, at (hXXps[:]//jointelegram4.co-tl[.]com/).
4) The actual phishing site will then prompt for the victim’s phone number, shown in Figure 1. This information will then be used by the Threat Actor to login to the victim’s Telegram account to start the account hijacking attempt, explained below.
Figure 2: Telegram One-Time Passcode (OTP) notification received by the victim
Figure 3: Phishing site page prompting for the victims’ Telegram login One-Time Passcode (OTP)
5) Once submitted the phone number, the victim will receive a notification from Telegram with the Login Code, as shown in Figure 2.
6) The phishing site will then prompt the victim for the 5-digit One-Time Passcode (OTP) in their Telegram application, as shown in Figure 3. This indicates that the Threat Actor has attempted to login to the victims’ Telegram account.
Figure 4 – Phishing site page prompting for the victims’ password in general.
7) After the victim key-in the 5-digit One-Time Passcode (OTP), the victim will be prompted for the Telegram account password, as shown in Figure 4. It is assumed that this page is trying to steal the user’s generic or primary password, which is assumed to be used repetitively for multiple accounts for the threat actor to attempt to login into.
Figure 5 – Page displaying a fake “eligibility status” for the financial aid request to the victim.
8) In the last stage, the victim is shown a fake page showing “Status Checking: Status Eligible” for the victim’s financial aid request, as shown in Figure 5. By this stage, the threat actor has obtained access and full control of the victim’s Telegram account and can lock out the victim. 
The threat actor can then use the stolen Telegram account to spread the phishing campaign further and potentially spread other fraud campaigns via the victim’s contact list in the Telegram account.
**2.0 Impact**
Telegram accounts are compromised, and the victim cannot access their Telegram account. Threat Actors can potentially use the compromised Telegram account to conduct further malicious activities.
**3.0 Affected System and Devices**
Below are references to similar incidents:
- MA-975.102023: MyCERT Alert - MyBayar PDRM Phishing Website
- MA-790.072020: MyCERT Alert - SMSSpy using Malaysian Law Enforcement as theme
- MA-843.072022: MyCERT Alert - Security Best Practices on Safe Online Transaction and Safeguarding Banking Information
**4.0 Recommendations**
The malicious email is meant to retrieve banking credentials and other information from victims, which could be used for other malicious purposes.  MyCERT highly recommends the following:
- Do not panic.
- Do not click any suspicious URLs sent through SMS, email, or any messaging services.
- Use different password variations for each online account and adhere to the best password management practices. This step should protect you in the future because no other account should be affected if one account is breached.
- Scan the device with a reputable antivirus/anti-spyware to ensure that the device is clean.
- Quickly file a police report if they encounter or fall victim to such scams.
- If you suspect unauthorised bank transactions in your account, immediately report to your bank by calling the bank's hotline, which normally operates 24x7.
- You can also call the Malaysian National Scam Response Centre (NSRC) hotline at 997 within 24 hours or as soon as possible. The hotline number operates daily, including on public holidays, between 8 a.m. and 8 p.m.
- The public can also contact the Royal Malaysia Police (PDRM) via the CCID Infoline at 013-211 1222 or the CCID Scam Response Centre at 03-2610 1559 or 03-2610 1599.
- Contact relevant authorities such as Cyber999 for any inquiries and assistance 
Generally, MyCERT advises users to follow the recommendations to prevent falling victim to the threat.
For further enquiries, don't hesitate to get in touch with MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://mycert.org.my/portal/advisory?id=MA-975.102023>
- <https://mycert.org.my/portal/advisory?id=MA-834.052022>
- <https://mycert.org.my/portal/advisory?id=MA-843.072022>