Telegram-Powered Credential Theft Campaign Sweeps Europe – Threat Advisory TA2025344

Summary

A sophisticated phishing campaign is actively targeting organizations across Central and Eastern Europe, leveraging specially crafted HTML attachments to steal user credentials through advanced social engineering tactics. This credential theft operation bypasses traditional security controls by embedding malicious JavaScript directly within HTML files, eliminating the need for external malicious links or remote command-and-control servers.

The phishing campaign impersonates trusted global brands including Adobe, Microsoft, FedEx, DocuSign, DHL, WeTransfer, and Telekom Deutschland to deceive victims into entering login credentials on convincing fake authentication pages. Stolen credentials are immediately exfiltrated to attacker-controlled Telegram bots, creating a fast, low-cost, and difficult-to-trace credential harvesting infrastructure.

This HTML-based phishing attack demonstrates significant evolution in cybercrime methodology, combining regional customization, realistic business communication lures, and anti-analysis techniques to breach even well-protected enterprise environments. The campaign has been assigned Threat Level Red with Admiralty Code A1, indicating highly reliable intelligence about an imminent and severe cybersecurity threat.

Targeted Industries: Agriculture & Livestock, Automotive, Construction, Consumer Goods, Education, Energy & Utilities, Government & Law Enforcement, Hospitality, IT & IT-Enabled Services, Manufacturing, Media & Entertainment, Professional Services, Retail, Telecommunications, Technology

Affected Regions: Czech Republic, Slovakia, Hungary, Germany, and broader Central and Eastern European territories

Attack Details

Phishing Campaign Infrastructure and Delivery Mechanism

This credential theft campaign represents a departure from traditional phishing methodologies by delivering self-contained malicious HTML files via email attachments rather than relying on compromised websites or phishing URLs. The HTML attachments use RFC-compliant filenames or are compressed into ZIP archives to appear legitimate and bypass email security filters that typically flag suspicious file types.

When victims open these phishing attachments, they encounter a convincing counterfeit Adobe login interface prompting users to “sign in to view” an attached document. This social engineering tactic exploits the common business practice of sharing documents through cloud services, making the credential harvesting attempt appear routine and trustworthy.

JavaScript-Based Credential Capture and Exfiltration

The technical sophistication of this phishing campaign centers on its use of embedded JavaScript to capture and exfiltrate credentials entirely within the HTML file itself. This design choice enables the attack to show minimal external network activity until the moment credentials are transmitted to Telegram, significantly reducing detection opportunities for security monitoring tools.

Two distinct malware variants have been identified demonstrating evolving levels of technical refinement:

Sample 1 (Advanced Variant): Implements CryptoJS AES encryption to obfuscate malicious code, making static analysis more difficult. This variant captures not only usernames and passwords but also victim IP addresses and browser fingerprinting data through external APIs. The credential theft mechanism includes a deceptive “incorrect password” error message, prompting victims to re-enter credentials and ensuring data accuracy for attackers.

Sample 2 (Streamlined Variant): Uses the native JavaScript Fetch API for a more efficient credential exfiltration process. This variant integrates sophisticated anti-analysis techniques that actively block developer tools shortcuts (F12, Ctrl+Shift+I), preventing security-conscious users from inspecting the malicious JavaScript code embedded in the HTML phishing page.

Telegram Bot Infrastructure for Data Exfiltration

Upon credential submission, victims unknowingly trigger a JavaScript-based POST request that sends their authentication data directly to the Telegram Bot API using hardcoded bot tokens and chat IDs. This exfiltration method offers attackers several operational advantages:

• No traditional command-and-control infrastructure required, reducing infrastructure costs and attribution risks
• Instant credential delivery via Telegram’s messaging platform
• Decentralized bot network managed by multiple threat actors, with evidence of token reuse suggesting collaboration or shared phishing toolkits
• Difficult network-based detection since Telegram traffic appears as legitimate encrypted messaging

Analysis revealed a network of distinct Telegram bots, each employing unique tokens with different behavioral patterns, indicating either a coordinated threat actor group or a phishing-as-a-service model where multiple cybercriminals share common attack infrastructure.

Brand Impersonation and Regional Targeting

The phishing campaign demonstrates sophisticated localization strategies, adapting communication styles and branding to match regional business practices across Central and Eastern Europe. The threat actors meticulously replicate the visual identity of globally recognized brands, with many HTML templates sharing consistent design elements such as Adobe-styled authentication modals and blurred invoice backgrounds.

This visual consistency across multiple phishing samples suggests the probable use of an automated phishing generator toolkit or standardized template library, enabling rapid campaign scaling while maintaining credible brand impersonation. The attackers blend localized language with internationally recognized corporate identities, creating a scalable credential theft infrastructure designed for maximum reach and victim trust.

Evasion and Persistence Techniques

The phishing campaign’s success stems from several key evasion capabilities:

• Self-contained execution model eliminates external dependencies that security tools typically monitor
• Legitimate-appearing filenames and ZIP compression bypass basic email attachment filters
• No malicious URL reputation since credentials are captured locally before Telegram exfiltration
• Anti-analysis measures prevent casual security inspection of malicious code
• Encryption obfuscation in advanced variants complicates automated detection

This combination creates a highly scalable, cost-effective credential theft operation that successfully evades traditional signature-based detection systems and URL filtering technologies commonly deployed in enterprise security architectures.

Recommendations

User Awareness and Email Security Hygiene

Be Cautious with HTML Attachments: Organizations should implement strict policies regarding HTML and ZIP attachments, especially those claiming to contain invoices, quotations, or shared documents. Security awareness training must emphasize that unexpected HTML attachments should be treated as suspicious until verified through trusted communication channels independent of email.

Verify Before You Click or Sign In: When any email requests credential entry to “sign in to view” a document, employees must confirm the request directly with the sender using a known email address or phone number from official company directories—never by replying to the suspicious email. Genuine companies rarely require authentication through attached files, making this a significant red flag for phishing attempts.

Infrastructure and Network Security Controls

Restrict Telegram API Access: Given the widespread use of Telegram bots for credential exfiltration in this campaign, network administrators should evaluate blocking Telegram’s API endpoints at the firewall or proxy level where operationally feasible. In enterprise environments where Telegram has no legitimate business use case, preventing outbound connections to api.telegram.org can effectively disrupt this exfiltration channel.

Enable Multi-factor Authentication (MFA): Even when credentials are successfully stolen through phishing attacks, multi-factor authentication provides a critical secondary defense layer preventing unauthorized account access. Organizations must enforce MFA across all critical business systems, privileged accounts, and cloud services to minimize credential theft impact.

Endpoint Protection and Detection Capabilities

Enhance Endpoint Protection: Deploy next-generation antivirus (NGAV) solutions and endpoint detection and response (EDR) platforms capable of identifying malicious behavior rather than relying solely on signature-based detection. Leverage behavioral analysis engines and machine learning-based threat detection to identify suspicious JavaScript execution patterns and unusual data exfiltration attempts characteristic of this phishing campaign.

Organizations should prioritize security solutions that can analyze HTML file contents, detect obfuscated JavaScript, and identify anomalous network communications even when encrypted through legitimate services like Telegram.

Indicators of Compromise (IoCs)

File Hash Indicators (SHA256)

The following SHA256 file hashes represent confirmed malicious HTML phishing attachments associated with this credential theft campaign:

• fb6b07ed5cbd049bb6126ada3ced943a66c5ca6b022aa10017512fa25521a21e
• 386e4755fd2fe87454936ddea4a01425f36d8ab434bf0f892054ac13bebdb2bd
• f3213b98a33b4f156f6f8860fdfa54b02479d662d80be8f59012aa1b0a77210d
• 30108ee705dba4a4c73e6b502d7899f66de65f51090d9119c0c6db6e6c316ee7
• 180bd9d3485762203a3450ddf25ba709fc2fa78eaf98c4e327ea6d55319dcdec
• ee1f979fc9ba43d9703af9339c61f6d68ffd662e30aa2eef8870ef652e49d062
• d2397acb1248e82e0ef52bbe9649aa379b111458691fae50b0e80ea88b7c5c8e
• 0a3077a21194e1e4266956d984fee66f8bb25061995d72b65a0bb9b851dd8b8b
• b205d3d54a53264fd638597dcaa57bc9550aecc47a244328c1f2e0d70e2489c6
• 594659e760e97b5ab4c7c790dce0c4bfb821bbe86cbb5acafd8151a17c458411
• e4375e379ce6d8bdc5d3d9064409d999b4e21a61dec6d5a7e697b4c3c574041c
• eb0d707327bc55e2f1f2933b5f759dc9d6174f6e315fadd17804deb5a0bea80d
• 753baed1c2d1fa4448b4c276cac50acafb82082ee7bca40df1b9f5f5b30b7736
• 1ecef19e4aed7f8e25719a7d10e40c18bf520eb127661ffe296abed1ef227a1c
• 2628c5da2061cba2963e45857d3d8db48902c261cc4fa61866e4e84518e408f4
• e8e99fb2e0c774f2709f9e1d0d4481738e563dc27cefce49a9aa3995ea33574c
• f1595bd2da01dc1e72430917ae18629640608afb1508ee21355007d483b2f64c
• ef498210b91af5ed513180fe5b4631612f6d05b2637ce90bd2488199832a269a
• 9c386f40e2f6111d5d96bfedad9d1eebe228887b8fecb12c1c89705f0b4ccd36
• cccf6a7a853b1940c658edb343ec4730cf38440c0885158d832e47ebd691e2f6

Organizations should integrate these file hash indicators into endpoint protection platforms, email security gateways, and threat intelligence feeds to enable automated detection and blocking of known malicious phishing attachments.

Note: Additional IoC indicators are available through the complete threat intelligence report on the HivePro platform.

MITRE ATT&CK TTPs

This credential theft campaign maps to the following MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs):

Initial Access

• T1566: Phishing – Primary attack vector for credential harvesting campaign
• T1566.001: Spearphishing Attachment – Malicious HTML files delivered via targeted emails

Execution

• T1204: User Execution – Requires victim interaction to open malicious HTML attachment
• T1204.002: Malicious File – HTML attachment executes embedded JavaScript
• T1059: Command and Scripting Interpreter – JavaScript execution for credential capture
• T1059.007: JavaScript – Core technique for credential theft and exfiltration logic

Defense Evasion

• T1027: Obfuscated Files or Information – CryptoJS AES encryption in advanced variants
• T1036: Masquerading – Impersonation of legitimate brands and business documents
• T1656: Impersonation – Fake login pages mimicking Adobe, Microsoft, and other trusted brands

Credential Access

• T1056: Input Capture – Capturing user credentials through fake authentication forms
• T1056.003: Web Portal Capture – Fake login interfaces harvesting credentials

Exfiltration

• T1567: Exfiltration Over Web Service – Telegram Bot API for credential exfiltration
• T1567.002: Exfiltration to Cloud Storage – Using Telegram as cloud-based exfiltration channel

Security teams should leverage these MITRE ATT&CK mappings to validate detection capabilities, tune security monitoring rules, and assess organizational resilience against this specific phishing campaign methodology.

References

https://cyble.com/blog/multi-brand-phishing-campaign-harvests-credentials/