FEMITBOT: fake Telegram bots and Mini Apps impersonate crypto brands to take deposits and push Android malware
Telegram users targeted with fake crypto and investment bots (impersonating MoonPay and other brands)
CTM360 found a shared fraud platform, FEMITBOT, behind many Telegram bots that open Mini App phishing pages inside Telegram, impersonating crypto services such as MoonPay (other outlets also list Bitget, OKX, Binance and Fragment) plus streaming and AI brands. Victims see fake balances and earnings and are told to deposit money or recruit others to 'unlock' withdrawals; some Mini Apps also push Android APK malware. No total losses have been published. Do not start bots or open Mini Apps from ads or unsolicited invites, and never pay to withdraw 'earnings'.
Why this severity: Still active, many people exposed.
- Started
- May 3, 2026
- Closed
- May 3, 2026
- Chains
- Multiple EVM chains
At risk
- Telegram users targeted with fake crypto and investment bots (impersonating MoonPay and other brands)
- Multiple EVM chains wallets
What to do now
- Stop sending money; the balance shown is fake. Uninstall any APK the bot offered and scan the phone. If you entered a seed phrase or key, move funds to a new wallet created on a clean device. Report the bot inside Telegram.
Stay safe
Am I affected?
If you started a Telegram bot from an ad or an unsolicited invite promising passive income, and its Mini App showed a balance you could only withdraw after a deposit or referrals, it is a scam. If you installed an APK it offered, your phone may be infected.
What to do now
Stop sending money; the balance shown is fake. Uninstall any APK the bot offered and scan the phone. If you entered a seed phrase or key, move funds to a new wallet created on a clean device. Report the bot inside Telegram.
How to avoid this
Reach crypto services only through their official website or app, not through bots found in ads. A real platform never asks for a deposit to release your earnings. Do not install Android apps from links inside Telegram.
Timeline 1
BleepingComputer reports CTM360's findings on FEMITBOT, a shared backend running fake Telegram bots and Mini Apps for crypto scams and Android malware.
Source
News & write-ups ›1
How this method works
Fake 'Safeguard' verification bots and fake trading bots trick you into running code, pasting a login or importing your private key. Read about fake telegram bots and 'verify' gates →
Follow new drains and updates in your feed reader or Telegram RSS bot.