{
 "slug": "femitbot-telegram-mini-app-fraud-may-2026",
 "title": "FEMITBOT: fake Telegram bots and Mini Apps impersonate crypto brands to take deposits and push Android malware",
 "url": "https://drains.watch/i/femitbot-telegram-mini-app-fraud-may-2026",
 "json": "https://drains.watch/i/femitbot-telegram-mini-app-fraud-may-2026.json",
 "status": "closed",
 "severity": "high",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "multi-evm"
 ],
 "method": "fake-telegram-bot",
 "product": "Telegram users targeted with fake crypto and investment bots (impersonating MoonPay and other brands)",
 "tags": [
  "multi-evm",
  "fake-telegram-bot",
  "telegram",
  "telegram-mini-app",
  "fake-bot",
  "femitbot",
  "investment-scam",
  "android-malware",
  "brand-impersonation",
  "moonpay"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2026-05-03",
 "closedAt": "2026-05-03",
 "updatedAt": "2026-05-03T12:00:00Z",
 "summary": "CTM360 found a shared fraud platform, FEMITBOT, behind many Telegram bots that open Mini App phishing pages inside Telegram, impersonating crypto services such as MoonPay (other outlets also list Bitget, OKX, Binance and Fragment) plus streaming and AI brands. Victims see fake balances and earnings and are told to deposit money or recruit others to 'unlock' withdrawals; some Mini Apps also push Android APK malware. No total losses have been published. Do not start bots or open Mini Apps from ads or unsolicited invites, and never pay to withdraw 'earnings'.",
 "timeline": [
  {
   "date": "2026-05-03",
   "title": "BleepingComputer reports CTM360's findings on FEMITBOT, a shared backend running fake Telegram bots and Mini Apps for crypto scams and Android malware.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/telegram-mini-apps-abused-for-crypto-scams-android-malware-delivery/"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Telegram Mini Apps abused for crypto scams, Android malware delivery",
   "url": "https://www.bleepingcomputer.com/news/security/telegram-mini-apps-abused-for-crypto-scams-android-malware-delivery/",
   "publisher": "BleepingComputer",
   "date": "2026-05-03"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nIf you started a Telegram bot from an ad or an unsolicited invite promising passive income, and its Mini App showed a balance you could only withdraw after a deposit or referrals, it is a scam. If you installed an APK it offered, your phone may be infected.\n\n## What to do now\nStop sending money; the balance shown is fake. Uninstall any APK the bot offered and scan the phone. If you entered a seed phrase or key, move funds to a new wallet created on a clean device. Report the bot inside Telegram.\n\n## How to avoid this\nReach crypto services only through their official website or app, not through bots found in ads. A real platform never asks for a deposit to release your earnings. Do not install Android apps from links inside Telegram.",
 "notes": null,
 "agentBrief": "# FEMITBOT: fake Telegram bots and Mini Apps impersonate crypto brands to take deposits and push Android malware\n\n- Severity: High · Status: Still active (past)\n- Chains: Multiple EVM chains · Method: Fake Telegram bots and 'verify' gates\n- Started: May 3, 2026 · Last update: May 3, 2026\n- Who/what: Telegram users targeted with fake crypto and investment bots (impersonating MoonPay and other brands)\n\nCTM360 found a shared fraud platform, FEMITBOT, behind many Telegram bots that open Mini App phishing pages inside Telegram, impersonating crypto services such as MoonPay (other outlets also list Bitget, OKX, Binance and Fragment) plus streaming and AI brands. Victims see fake balances and earnings and are told to deposit money or recruit others to 'unlock' withdrawals; some Mini Apps also push Android APK malware. No total losses have been published. Do not start bots or open Mini Apps from ads or unsolicited invites, and never pay to withdraw 'earnings'.\n\n## Am I affected?\nIf you started a Telegram bot from an ad or an unsolicited invite promising passive income, and its Mini App showed a balance you could only withdraw after a deposit or referrals, it is a scam. If you installed an APK it offered, your phone may be infected.\n\n## What to do now\nStop sending money; the balance shown is fake. Uninstall any APK the bot offered and scan the phone. If you entered a seed phrase or key, move funds to a new wallet created on a clean device. Report the bot inside Telegram.\n\n## How to avoid this\nReach crypto services only through their official website or app, not through bots found in ads. A real platform never asks for a deposit to release your earnings. Do not install Android apps from links inside Telegram.\n\n## Sources\n- Telegram Mini Apps abused for crypto scams, Android malware delivery (BleepingComputer, 2026-05-03): https://www.bleepingcomputer.com/news/security/telegram-mini-apps-abused-for-crypto-scams-android-malware-delivery/\n\nFull record: https://drains.watch/i/femitbot-telegram-mini-app-fraud-may-2026 · JSON: https://drains.watch/i/femitbot-telegram-mini-app-fraud-may-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}