Telekopye

Telekopye is a malicious software, or malware, that has been utilized by a group of cybercriminals referred to as "Neanderthals" for well-organized phishing campaigns. Since its inception in 2016, Telekopye has facilitated the creation of fraudulent links, web pages, QR codes, and convincing images, primarily via phishing emails, SMS messages, and suspicious downloads. The toolkit has been particularly effective in creating phony websites, enabling the Neanderthals to scam online marketplace users and more recently, travelers in the hotel and apartment booking sector. The Russian hackers have used this custom malware in broad phishing attacks, leveraging it as a Telegram bot to scam marketplace users and defraud travelers. In addition to these activities, Telekopye operators use additional bots for money laundering, market research scraping, and implementing DDoS protection. Notably, there was a surge in accommodation-themed scams in July 2024 which, for the first time, surpassed Telekopye’s original marketplace-targeted scams. To combat the threats posed by Telekopye, cybersecurity firm ESET recommends awareness of the Neanderthals' tactics and exercising caution on affected platforms. Indicators of potential scams include suspicious links and requests for personal information. Using a reputable anti-malware solution is also strongly advised to provide protection against being lured to a phishing website. Despite these countermeasures, the Telekopye groups continue to refine their tools and operations, indicating an ongoing threat to online security.