Analysis of Multi-Stage Phishing Kits Leveraging Telegram for Credential Theft and Evasion Techniques

According to Group-IB, researchers have uncovered a sophisticated phishing framework that industrialises credential theft through automation, evasion techniques and Telegram-based data exfiltration. The kit targets Aruba S.p.A., an Italian IT services provider serving over 5.4 million customers, highlighting the financial and operational risks posed by modern phishing-as-a-service operations.

It represents a fully automated, multi-stage platform, with a four-stage attack process beginning after bypassing a CAPTCHA filter and culminating in credential harvesting via a high-fidelity replica of the Aruba[.]it customer login portal. Victims are then presented with a fake payment page asking for a small, plausible fee of approximately €4.37, designed to capture full card details, followed by a fake 3D Secure or one-time password verification page to harvest OTPs.

Telegram serves as the operational backbone, with multiple Telegram bots configured to receive stolen credentials and payment information, and dual exfiltration channels to ensure data reaches attackers even if primary channels fail.