Scammers are exploiting the rising popularity of Telegram and its associated cryptocurrency, Toncoin (TON), to execute a highly scalable scheme design to pilfer the digital tokens from unsuspecting users. Kaspersky researchers have discovered the operation, which has been active since November 2023, and warns that it is a growing threat.

Victims are being lured into the scheme via an invitation to join an “exclusive earning program” received from a contact in their list. The invitation leads them to an unofficial Telegram bot, falsely touted as a cryptocurrency storage solution. The victims are then instructed to link it to a legitimate wallet and to buy Toncoins through official channels such as the official Telegram bot or through cryptocurrency exchanges.

After duping victims into purchasing the coins, scammers push them to buy so-called ‘boosters’ using a separate bot, stating that this is the step needed to commence earning. The ‘boosters’, likened to those seen in online games, are misleadingly marketed as tools that allow users to capitalise on their coins further. “This scheme resembles boosters in online games – by purchasing one, the user gains additional advantages,” explains Olga Svistunova, Senior Web Content Analyst at Kaspersky. Once bought these ‘boosters’ cost victims their cryptocurrency, and the money lost is irreversible.

Following the purchase of the scam ‘boosters’, users are manipulated into propagating the scheme. They are encouraged to create a private Telegram group with their friends and acquaintances, share a specially generated referral link and a video with instructions on earnings. The scammers claim that at least five people should join the private group via the referral link before a victim can start earning. They are also told that they will receive payment for each friend invited and will make a commission from each of the fraudulent ‘boosters’ purchased by those they have referred.

Alluding to the potential scale of the scam, the Telegram Open Network (TON) was developed by the Durov brothers and is now backed by an independent community. Telegram itself has reached 900 million monthly users and ranks globally as the 6th most used and 6th most downloaded app. This expansive user base increases both the potential pool of victims and the likely impacts of the scheme.

Kaspersky experts have urged all users to exercise caution when encountering offers of quick riches, even if they are received from friends or acquaintances. Avoid transferring cryptocurrency to unknown or suspicious wallets, and consider comprehensive protection for your digital assets, such as Kaspersky Premium which alerts you to suspicious websites and guards your wallet against scammers, miners and other threats. Staying updated and informed about the latest fraudulent schemes is another effective protective measure.