Smishing Alert: Telegram Bots Power New PNB MetLife Phishing Campaign

A new smishing campaign targeting PNB MetLife policyholders has been uncovered, with attackers using Telegram Bots to power real‑time data exfiltration and bypass traditional C2 servers. Security researchers describe the operation as mobile‑friendly, designed to harvest sensitive personal data, banking credentials and even enable fraudulent UPI payments.

The pages are optimised for mobile and use brand familiarity to lower victim resistance, while the data is sent directly to Telegram where it can be monitored in real time by the attackers; tokens for bots such as pnbmetlifesbot and goldenxspy_bot are hardcoded into the malicious JavaScript.

The campaign includes specific operator accounts, including darkdevil_pnb and prabhatspy, receiving the stolen data streams, and uses a trick to manipulate the victim’s clipboard to copy the attacker’s UPI ID and redirect to payment app deep links. A second variant promises refunds or AutoDebit to steal full banking details, with victims asked to enter bank and card data which is beamed to the attackers via the goldenxspy_bot, while hosting pages on EdgeOne Pages enable rapid deployment.