Security Alert: Telegram & WhatsApp "Session-Grabber" Phishing Targeting Iranian Journalists

A real-time account-takeover ("session-grabber") campaign is hijacking the Telegram and WhatsApp accounts of Iranian journalists and civil-society figures. The operator makes contact over WhatsApp while impersonating someone the target knows, then sends a link to a counterfeit Telegram "Private Chat" page hosted on a homoglyph domain — teiegram[.]site, which displays as "Telegram.site" because the lowercase "l" is replaced by a capital "I" (teIegram). The page induces the victim to relay the genuine Telegram login code sent to their device and, in a second step, their Two-Step Verification (2FA) cloud password — handing the operator full control of the account within seconds. The same server hosts a parallel WhatsApp phishing kit. Because the homoglyph is pure ASCII, it produces no punycode and triggers no browser warning.

Phishing Kit Analysis

The kit is a server-side web application (Python, uvicorn/FastAPI) that performs an adversary-in-the-middle relay against Telegram's real authentication system — it does not harvest a static password, it steals a live session.

Hosting & Origin:

• Lure domain: teiegram[.]site (homoglyph of telegram.site), Cloudflare-fronted; registrar Ultahost
• Per-victim subdomains: my[.]teiegram[.]site, private[.]teiegram[.]site
• Origin server: 84[.]200[.]24[.]161 — Ultahost (AS214036), Frankfurt, Germany; kit served on TCP/8081
• Exposed services on the origin: 135 (RPC), 445 (SMB), 3389 (RDP), 5985 / 47001 (WinRM)

Lure Page:

• Telegram logo; headings "Private Chat" and "System locked to your number"; a "Join Group" button

• Post-takeover, the kit shows a fake "Private Dashboard — Syncing Data…" view pre-seeded with Iranian opposition media channels (BBC Persian, Iran International, DW Persian, Radio Zamaneh) to appear legitimate while the account is seized

Backend Endpoints:

Attack Flow:

1. Contact over WhatsApp impersonating a known person ("it's my new number"), proposing a project / interview / "live session"
2. Delivery of a "Private Chat — do not share this link" card linking to my[.]teiegram[.]site / private[.]teiegram[.]site
3. Victim clicks "Join Group"; the backend starts a real Telegram login and Telegram sends the genuine code to the victim
4. Victim enters the code on the fake page; the backend relays it to log in as the victim (defeats SMS/app one-time codes)
5. A "Two-Step Verification — Unlock Account" screen captures the victim's 2FA cloud password
6. A fake dashboard masks the takeover; the operator can read chats/contacts and impersonate the victim to their network

Malicious Behaviors (MITRE ATT&CK):

Key Capabilities:

• Real-time relay of Telegram login codes (defeats SMS- and app-based one-time codes)
• Harvesting of the Telegram 2-Step Verification (2FA) cloud password
• Live read access to the victim's chats and contacts
• Account impersonation to spread the campaign through the victim's network
• A parallel WhatsApp account-phishing kit on the same server

Social Engineering & Delivery Analysis

The lure is delivered over WhatsApp from a UK number, +44 7576 076203, under the display name "Asghar.ramzanpour" (اصغر رمضان‌پور), impersonating a contact the target knows. The operator pre-empts the unfamiliar number ("it's my new number"), proposes a project / interview / "live session," sends a "Private Chat" link marked "do not share with anyone," and applies time pressure ("the team is on air").

Message Content (Translated, representative):

• "[Private Chat] Warning: Do not share this link with anyone else — my.Telegram.site"
• "Hit Join — the session login code will be sent to your Telegram — enter it."
• "It's the old friends you've talked with before."
• "Did you join? The team is on air now."

The same operator approached at least two Iranian journalists in the same week. One of them, Ahmad Batebi (@radiojibi - x.com), publicly disclosed the attack, including a screen recording of the lure and the operator's WhatsApp profile.

Attribution Indicators

While a confirmed infrastructure overlap with a previously documented cluster has not been established, multiple indicators point to an Iranian state-sponsored operation:

• Victimology: targets are exclusively Iranian journalists, dissidents, and opposition-linked individuals; the kit's fake dashboard is pre-seeded with Iranian opposition media channels.
• Tooling / kit family: a Telegram login-code relay combined with a 2FA-password harvest — the same technique family that researchers have associated with MOIS Telegram-account-takeover operations.
• Delivery tradecraft: impersonation of a known contact with a "new number," and an interview / collaboration / "live session" pretext, pivoting from WhatsApp to a phishing link.
• Language: native, colloquial Persian.
• Corroboration: the activity coincides with a public warning from Iran International about impersonation-based cyberattacks on its journalists, and with the public disclosure by journalist Ahmad Batebi of an identical attack.

Assessment: CERTFA assesses, with moderate-to-high confidence, that this operation most likely belongs to the MOIS cluster tracked as Banished Kitten (also Storm-0842 / "Dune"), contractor-operated via the front company Parsian Afzar Rayan Borna. The IRGC-linked APT42 / "Charming Kitten" is retained as a less-likely alternative for the social-engineering layer. The kit observed here is a FastAPI build distinct from the previously-documented (Django-based) variant — the same logic in a different implementation, suggesting an evolved or parallel version. Public reporting genuinely diverges on the sponsoring service (IRGC vs MOIS); this assessment is tradecraft- and victimology-based, not a confirmed infrastructure overlap.

Indicators of Compromise (IOCs)

Domains & Hosts

Origin Infrastructure

Delivery / Contact Indicators

Related but SEPARATE Operation (do not conflate)

The teiegram homoglyph is also abused by an unrelated, China-market actor. These indicators are not part of the operation above and are listed only to prevent over-attribution:

Recommendations

• Never enter a Telegram or WhatsApp login code on any website. Login codes belong only inside the official app; any web page asking for your code is an attack.
• Never enter your Telegram Two-Step Verification password into a link. Set a 2FA cloud password, but treat it like a recovery key — never type it anywhere reached from a message.
• Treat a "known contact" who reaches out from a new number and steers you toward a link or a "live session" as suspicious; verify through a second, trusted channel.
• Inspect links carefully — teIegram (capital "I") is not telegram. Prefer the official apps over web links.
• If you may have entered a code or password: from a known-good device, open Settings → Devices and terminate all other sessions, reset your Two-Step Verification password, and warn your contacts that messages sent from your account may have been attacker-controlled.