Telegram-Powered Phishing Campaign Targets European Businesses Using HTML Attachments to Steal Credentials

Researchers from Cyble Research and Intelligence Labs (CRIL) have uncovered a massive, multi-brand phishing campaign that uses HTML email attachments to steal credentials, exfiltrating data directly to attacker-controlled Telegram bots.

According to CRIL, the embedded HTML files run JavaScript that reads user inputs and performs an HTTP POST to https://api.telegram[.]org/bot<BotToken>/sendMessage with chat_id and text fields containing the harvested credentials, while displaying an “invalid login” message to avoid suspicion.

The operation impersonates a range of brands, including Adobe, Microsoft, WeTransfer, and DocuSign, with attackers targeting Central and Eastern Europe and sectors such as energy, manufacturing, telecommunications and government. CRIL noted a decentralized network of active bots operated by multiple threat actors and evidence of infrastructure reuse across campaigns, with identical bot tokens appearing in different brand-themed templates.

Some samples employ encryption or anti-forensics defenses and a dual-password capture mechanism, complicating analysis. The findings, published on 11 November 2025, highlight how HTML attachments combined with Telegram C2 can enable scalable credential harvesting.