Telegram Mini Apps abused for crypto scams, Android malware delivery

Cybersecurity researchers uncovered a large‑scale fraud operation that leverages Telegram’s Mini App feature to run crypto scams, impersonate well‑known brands, and distribute Android malware. The platform, dubbed FEMITBOT, uses Telegram bots and embedded Mini Apps to create convincing app‑like experiences directly within the messaging platform. FEMITBOT’s shared backend serves phishing pages that display fake balances, countdown timers, and deposit prompts, while also distributing Android APKs that mimic legitimate software such as BBC, NVIDIA, CineTV, Coreweave, and Claro. The operation impersonated brands including Apple, Coca‑Cola, Disney, eBay, IBM, Moon Pay, NVIDIA, and YouKu, and employed Meta and TikTok tracking pixels to measure conversions. Users are prompted to download APK files or install progressive web apps from within the Telegram in‑app browser, bypassing Google Play Store safeguards.

The campaign demonstrates how attackers can embed malicious content in a popular messaging app’s native browser, making it appear as part of the app itself. The use of shared backend infrastructure allows rapid rebranding and language changes, while the APK filenames are carefully chosen to resemble legitimate applications, reducing user suspicion.