The Malware Watched Back: Inside a Telegram Fraud Operation

Malware is normally designed to watch victims. This time, it watched the operator instead.

While analyzing more than 200,000 artifacts collected from thousands of infected machines, we found one environment that stood out.

Instead of simply exposing another victim, the malware provided a window into a Telegram-based fraud operation called Secret Work.

Across hundreds of captured artifacts, we reconstructed an operational chain:

Acquire → Isolate → Verify → Create/Take Over → Fund/Transfer → Fabricate Proof → Sell/Support

We observed identity and payment data, isolated browser profiles, residential proxies, temporary phone numbers, cryptocurrency activity, account workflows, and the infrastructure used to support the operation.

One of the most interesting findings was how the operator appeared to manufacture success. Coinbase transaction information was locally manipulated through browser DevTools—including making an incentive reward appear as $2,000—and fabricated Coinbase reward evidence was subsequently posted to Secret Work.

The underlying transaction didn't need to change.

Only what prospective customers saw needed to change.

The investigation provides a rare look beyond the advertisement and into the workflow behind a cybercrime operation—including what the evidence tells us about attribution and, equally importantly, what it does not.

Read the full CyberArmor research paper: The Malware Watched Back: Inside a Telegram Fraud Operation.

The malware was built to watch.

This time, it watched back.