The FEMITBOT Ecosystem: How Threat Actors Weaponize Telegram Mini Apps for Scalable Fraud and Malware

A sophisticated, large-scale cybercrime operation known as FEMITBOT has emerged, leveraging the inherent trust of Telegram Mini Apps to orchestrate a dual-threat campaign: high-fidelity cryptocurrency phishing and Android malware distribution.

This campaign serves as a critical case study in how legitimate “super-app” features—designed to provide seamless user experiences—can be inverted to facilitate advanced social engineering and automated credential theft.

Telegram Mini Apps are lightweight, web-based applications that operate within Telegram’s ecosystem, offering integrated payment gateways and native-feeling interfaces. FEMITBOT operators exploit this seamlessness by deploying deceptive Mini Apps that load malicious phishing environments directly within Telegram’s internal WebView. To the unsuspecting user, the interface feels like a legitimate, sanctioned part of the Telegram experience.

The technical execution begins when a user interacts with a malicious bot and selects “Launch App.” The Mini App then initializes by integrating the official Telegram WebApp SDK. By loading this legitimate script from Telegram’s own domain, the attackers bypass many basic security heuristics. This integration allows the phishing site to silently intercept a data blob known as initData, which contains the user’s unique ID, display name, and a cryptographic authentication hash.

According to CTM360’s forensic analysis, FEMITBOT is not a localized scam but a massive, multi-vertical fraud engine. The operation impersonates a vast array of blue-chip brands, including streaming giants like Netflix and BBC, crypto exchanges such as Binance, Bitget, and OKX, and even high-tech firms like NVIDIA to lure victims into fake cloud mining or AI compute schemes.

The infrastructure behind FEMITBOT is remarkably modular and professionally managed. Analysts have identified at least 15 distinct Mini App “skins,” over 60 active domains, and upwards of 140 Telegram bots all feeding into a unified backend. The presence of a common API response across these disparate entities confirms a centralized command-and-control (C2) structure designed for massive scale.

Technical Breakdown: The Conversion Funnel and Malware Delivery

The FEMITBOT lifecycle follows a sophisticated “conversion funnel” typical of high-end performance marketing. Victims are funneled through Meta (Facebook/Instagram) advertisements or Telegram invite links, lured by promises of passive income or premium services. Once the Mini App is launched, the stolen initData is transmitted to a backend API, which issues a JSON Web Token (JWT) cookie. This allows the attacker to maintain an authenticated session for the victim for up to ten days without ever requiring a password.

To drive financial exploitation, the dashboard utilizes psychological triggers: fake real-time earnings counters, countdown timers, and “limited VIP slots.” This creates an artificial sense of urgency, pressuring the user to make an “activation” deposit to unlock their perceived winnings.

What makes FEMITBOT particularly dangerous is its use of legitimate Ad-Tech infrastructure. The attackers embed Meta (Facebook) and TikTok pixels within their phishing sites. By tracking PageView, Purchase, and rePurchase events, the threat actors can perform real-time optimization of their lures, identifying which specific brands or social media channels yield the highest Return on Investment (ROI).

Beyond financial theft, the platform includes a secondary payload: Android Malware. The backend utilizes feature flags to toggle an appdownloadshowswitch setting. When activated, the Mini App prompts the user to download an Android Package Kit (APK). To bypass browser security warnings and maintain TLS certificate validity, these malicious APKs are hosted on the same domains used for the phishing API.

Delivery methods include:

• Direct APK downloads: Standard file downloads disguised as legitimate software.
• In-app browser flows: Exploiting the WebView to minimize suspicion.
• Progressive Web App (PWA) prompts: Tricking users into adding a malicious shortcut to their home screen, which acts as a persistent gateway for future attacks.

FEMITBOT represents a shift toward “Fraud-as-a-Service,” where criminal operations mirror the precision of legitimate digital marketing firms. Security professionals should prioritize monitoring for anomalous WebApp SDK usage and suspicious pixel activity tied to Telegram-based domains. For the average user, the rule of thumb remains: avoid sideloading APKs from messaging apps and treat all high-yield investment offers within Telegram with extreme skepticism.