# Telegram Dark Markets Fuel Modern Phishing Operations (Guardio Labs 'Scammers Paradise')

> Guardio Labs reports that phishing pages (scampages), kits, leads and mailer tooling are openly sold on public Telegram channels, groups and bots. A full Bank of America phishing campaign targeting 100,000 recipients was assembled for about $230, including scampages with 2FA/OTP bypass and real-time account hijacking, backdoor mailers (Leaf PHPMailer) and web shells on compromised sites.

- **Published:** 2026-10-17T00:21:22Z
- **Last reviewed:** 2026-10-17T00:21:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3790
- **ID:** TL-2026-3790
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Guardio Labs (report dated 2024-01-29) documents a Telegram-based supply chain for phishing-as-a-commodity. Public channels, groups and bots sell scampages (fake login pages), phishing kits, scampage generator bots (e.g. a crypto giveaway generator and an Amazon scampage offer), leads lists, hacked SMTP credentials, SendGrid and Amazon SES accounts, hosting (bulletproof hosting, cPanel resale and free samples of web shells on compromised WordPress sites) and mailers. Basic scampages start at about $10; advanced pages with 2FA/OTP bypass and real-time hijacking range from $100 to $800+.

The 2FA/OTP bypass scampages use an active proxy that connects to the real service: the victim logs into a fake interface and enters their 2FA codes while the credentials are relayed to the real service through proxy automation, so the operator can hijack the session or account in real time. Kits also include anti-bot / anti-scanning protections and automated exfiltration of captured data via Telegram.

Guardio's worked example built an end-to-end Bank of America campaign for about $230: a scampage (negotiated down to $30), a leads list of 100,000 Bank of America customers ($200), free or hacked hosting through web shells on compromised WordPress sites, and free or backdoor mailers. Mailer options include Leaf PHPMailer, a PHP hacktool based on an open-source mailer library that sends large volumes of malspam from a compromised site's web server, with forged sender, reply-to, subject and body fields and a blacklist checker (Sucuri analysis), as well as pre-owned SendGrid/Amazon SES accounts with daily limits of 20,000 to 500,000 emails. Stolen credentials ('logs') are resold; Guardio's projection was a return from $230 to at least $2,350 assuming 50 valid credentials (5 premium at $200 and 45 basic at $30).

Targeted brands named across Guardio's reporting: Bank of America, Amazon, Office 365, cryptocurrency services, social media platforms (Facebook) and USPS. The sources name no threat actors and publish no network or file IOCs, so the IOC set below is limited to the tooling, services and platforms evidenced. Severity is analyst-assigned (the source does not state one). Scale context from Guardio: roughly 3.4 billion phishing emails are sent daily.

## MITRE ATT&CK

- T1588.002 Tool
- T1584.004 Compromise Infrastructure: Server
- T1583.006 Acquire Infrastructure: Web Services
- T1586.002 Compromise Accounts: Email Accounts
- T1608.005 Stage Capabilities: Link Target
- T1566.002 Phishing: Spearphishing Link
- T1078 Valid Accounts
- T1505.003 Server Software Component: Web Shell
- T1111 Multi-Factor Authentication Interception
- T1090 Proxy
- T1567 Exfiltration Over Web Service

## Sources

- ["Scammers Paradise" - Exploring Telegram's Dark Markets, Breeding Ground for Modern Phishing Operations (Guardio Labs)](https://guard.io/labs/scammers-paradise-exploring-telegrams-dark-markets-breeding-ground-for-modern-phishing)
- [Telegram Phishing Scamming Operation (Guardio blog)](https://guard.io/blog/telegram-phishing-scamming-operation)
- [Phishing & Malspam with Leaf PHPMailer (Sucuri)](https://blog.sucuri.net/?p=27497)
- [Phishing and Malspam with Leaf PHPMailer (Cyware)](https://social.cyware.com/news/phishing-and-malspam-with-leaf-phpmailer-b8b38401)
- [Scammers Paradise mirror (hendryadrian.com)](https://www.hendryadrian.com/?p=9822)
- [Telegram: Die neue Arena der Cyberkriminalitat (Mimikama)](https://www.mimikama.org/?p=340235)
- [Telegram is home to many scammers (Digital Information World)](https://www.digitalinformationworld.com/2024/02/telegram-is-home-to-many-scammers-and.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3790