Threat reportPhishingTL-2026-3790
Telegram Dark Markets Fuel Modern Phishing Operations (Guardio Labs 'Scammers Paradise')
Telegram Dark Markets Fuel Modern Phishing Operations (TL-2026-3790), also tracked as Scammers Paradise, is a medium-severity phishing campaign, first published 2026-10-17. It has no confirmed attribution, affects Various Online banking, e-commerce, Office 365, social media and, maps to 11 MITRE ATT&CK techniques (T1078, T1090, T1111), and is covered by 9 detection rules and 14 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 11MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-3790
- Threat ID
- TL-2026-3790
- Also known as
- Scammers Paradise
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, retail, technology, cryptocurrency, consumer
- Target regions
- North America, Global
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in Telegram Dark Markets Fuel Modern Phishing Operations
Malware and tooling: Leaf PHPMailer, telegram, 2FA/OTP-bypass scampage with active reverse proxy, Amazon scampage offer, Crypto Giveaway scampage generator bot
How Telegram Dark Markets Fuel Modern Phishing Operations works
Guardio Labs reports that phishing pages (scampages), kits, leads and mailer tooling are openly sold on public Telegram channels, groups and bots. A full Bank of America phishing campaign targeting 100,000 recipients was assembled for about $230, including scampages with 2FA/OTP bypass and real-time account hijacking, backdoor mailers (Leaf PHPMailer) and web shells on compromised sites.
Guardio Labs (report dated 2024-01-29) documents a Telegram-based supply chain for phishing-as-a-commodity. Public channels, groups and bots sell scampages (fake login pages), phishing kits, scampage generator bots (e.g. a crypto giveaway generator and an Amazon scampage offer), leads lists, hacked SMTP credentials, SendGrid and Amazon SES accounts, hosting (bulletproof hosting, cPanel resale and free samples of web shells on compromised WordPress sites) and mailers. Basic scampages start at about $10; advanced pages with 2FA/OTP bypass and real-time hijacking range from $100 to $800+.
The 2FA/OTP bypass scampages use an active proxy that connects to the real service: the victim logs into a fake interface and enters their 2FA codes while the credentials are relayed to the real service through proxy automation, so the operator can hijack the session or account in real time. Kits also include anti-bot / anti-scanning protections and automated exfiltration of captured data via Telegram.
Guardio's worked example built an end-to-end Bank of America campaign for about $230: a scampage (negotiated down to $30), a leads list of 100,000 Bank of America customers ($200), free or hacked hosting through web shells on compromised WordPress sites, and free or backdoor mailers. Mailer options include Leaf PHPMailer, a PHP hacktool based on an open-source mailer library that sends large volumes of malspam from a compromised site's web server, with forged sender, reply-to, subject and body fields and a blacklist checker (Sucuri analysis), as well as pre-owned SendGrid/Amazon SES accounts with daily limits of 20,000 to 500,000 emails. Stolen credentials ('logs') are resold; Guardio's projection was a return from $230 to at least $2,350 assuming 50 valid credentials (5 premium at $200 and 45 basic at $30).
Targeted brands named across Guardio's reporting: Bank of America, Amazon, Office 365, cryptocurrency services, social media platforms (Facebook) and USPS. The sources name no threat actors and publish no network or file IOCs, so the IOC set below is limited to the tooling, services and platforms evidenced. Severity is analyst-assigned (the source does not state one). Scale context from Guardio: roughly 3.4 billion phishing emails are sent daily.
MITRE ATT&CK techniques used in TL-2026-3790
Initial Access
T1078 Valid Accounts; T1566.002 Phishing: Spearphishing Link
Command and Control
Credential Access
T1111 Multi-Factor Authentication Interception
Persistence
T1505.003 Server Software Component: Web Shell
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1583.006 Acquire Infrastructure: Web Services; T1584.004 Compromise Infrastructure: Server; T1586.002 Compromise Accounts: Email Accounts; T1588.002 Tool; T1608.005 Stage Capabilities: Link Target
Affected products and versions in Telegram Dark Markets Fuel Modern Phishing Operations
- Various — Online banking, e-commerce, Office 365, social media and cryptocurrency account holders (credential and 2FA/OTP phishing targets)
- Automattic / WordPress ecosystem — Compromised WordPress sites used as scampage hosts and mailers via web shells
Remediation for Telegram Dark Markets Fuel Modern Phishing Operations
Immediate actions
- Block and report phishing URLs; verify links before clicking (e.g. 'link sandwiching') and scan suspicious URLs with a URL scanner
- Enable 2FA on accounts and monitor for unexpected login attempts
- Report scam channels to @SpamBot on Telegram
Workarounds
- Engage professional malware cleanup for sites found hosting web shells or Leaf PHPMailer
- Review outbound mail from web servers and rotate SMTP / SendGrid / SES credentials if abused
Longer-term hardening
- Website owners: harden CMS (WordPress) installations, keep software and plugins patched, and deploy a web application firewall to prevent compromised sites being used as phishing hosts or mailers
- Use phishing-resistant authentication (FIDO2/passkeys) since proxy-relay scampages defeat OTP-based 2FA
- Monitor dark web / Telegram for leaked customer data and brand-impersonating scampages
Timeline of Telegram Dark Markets Fuel Modern Phishing Operations
- Sucuri publishes analysis of the Leaf PHPMailer hacktool used to send malspam from compromised website web servers (month-level date: October 2020)
- Guardio projects $230 outlay returning at least $2,350 by reselling 50 valid credential 'logs' (5 premium at $200, 45 basic at $30)
- Example campaign buys a 100,000-customer Bank of America leads list for $200 and sources free web shells on compromised WordPress sites plus free/backdoor mailers; total cost about $230
- Guardio's worked example acquires a Bank of America scampage (price negotiated to $30); 2FA/OTP-bypass proxy pages range $100-$800+
- Guardio Labs publishes 'Scammers Paradise', documenting open sale of phishing pages, kits, leads and mailers on public Telegram channels, groups and bots
- Findings are covered by secondary outlets (Digital Information World, Mimikama) in February 2024 (month-level date)
Sources cited for Telegram Dark Markets Fuel Modern Phishing Operations
- "Scammers Paradise" - Exploring Telegram's Dark Markets, Breeding Ground for Modern Phishing Operations (Guardio Labs)
- Telegram Phishing Scamming Operation (Guardio blog)
- Phishing & Malspam with Leaf PHPMailer (Sucuri)
- Phishing and Malspam with Leaf PHPMailer (Cyware)
- Scammers Paradise mirror (hendryadrian.com)
- Telegram: Die neue Arena der Cyberkriminalitat (Mimikama)
- Telegram is home to many scammers (Digital Information World)
Detection coverage for TL-2026-3790
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3790 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.