Automating Phishing with Next-Generation Telegram Bots (DeepPhish)

[Good Carder]

Generating phishing pages using LLM, automated distribution via hacked Telegram accounts, and intercepting sessions by spoofing QR codes.​

From carders to carders. Good old phishing via email with spelling errors and suspicious links is dead. In 2027, DeepPhish entered the picture — a fully automated phishing infrastructure built on Telegram. Why Telegram? Because it's the most convenient channel for carders: a billion users, built-in bots, full automation, encryption (which works for us too), relative anonymity, and, most importantly, a gigantic audience reach. According to Chainaanalysis and Aura data for 2026, AI technologies increased cybercriminal profitability by 4.5 times.

In this article, I'll explore DeepPhish — a symbiosis of AI content, Telegram APIs, and human gullibility. You'll learn how ready-made AI phishing kits (BlackForce, GhostFrame, Darcula) work, how to set up your own bot for mass mailings, how automated data collection works, how 2FA is bypassed via Evilginx3, and how Telegram sessions are stolen. We'll also cover the latest scheme: fake Telegram Mini Apps for stealing crypto wallets. And, of course, we won't forget about OPSEC: how Telegram combats abuse and how to circumvent it.

Part 1: What is DeepPhish and why 2027 is a turning point​

DeepPhish is not a specific program, but a class of threats. It is a fully automated pipeline that includes:

• AI content generation (LLM creates personalized emails and messages that are indistinguishable from real ones, in any language);
• Telegram bots for distributing, receiving data and coordinating;
• Reverse-proxy interception of sessions and 2FA codes.

All of this is sold as a service ("Phishing-as-a-Service" or PhaaS), with prices ranging from €200 to $1,000 for a package capable of supporting millions of attacks.

The key difference in 2027 is mass personalization. Carders use public data (social media, LinkedIn) to generate messages that address the victim by name, mentioning their company and job title. AI removes the main phishing marker — grammatical errors — and Telegram bots serve as an ideal platform for data collection and communication.

That same year, studies showed that AI increases the effectiveness of fraud by 4.5 times, and Telegram became the main platform.

Part 2. AI-based Phishing Content Generation: LLM Engine​

The heart of DeepPhish is the Large Language Model (LLM). It creates messages that are indistinguishable from the real thing.

2.1. Open and criminal LLMs​

• A black market for criminal LLMs (FraudGPT, WormGPT, KawaiiGPT). These models are uncensored and capable of generating malicious code, phishing pages, and convincing emails. KawaiiGPT, discovered in mid-2025 and updated to version 2.5, has become popular among beginners, is completely free, and produces phishing pages on demand. They are trained exclusively on malicious examples, have no ethical restrictions, and can generate any content.
• Jailbroken versions of legitimate LLMs. Reflashed ChatGPT/Claude versions are capable of the same things as criminal models.

2.2. What does automated generation (prompt) look like?​

System prompt: "You are a marketer sending personalized offers on behalf of [Apple/Microsoft/Binance]. Your goal is to convince the user to click the link and log in. Use an official tone, without dubious or suspicious phrases ." User prompt (inserted via OSINT): "Name: Ivan Petrov. Position: Engineer at TechCorp. Email: ivan@techcorp.com. Company: Uses Apple Business Manager. Generate a notification about a supposedly expired Apple ID subscription, asking for confirmation within 24 hours". The output is a ready-made email that will pass spam filters.

This is how LLM "prints" thousands of personalized messages per minute, in any language.

Part 3. Telegram Bots: From Sending to Data Collection​

Telegram is a universal harvester for a phisher.

3.1. Bot as a control interface​

The attacker interacts with the phishing campaign through a special bot:

1. Select a phishing page template or upload your own.
2. The bot generates a link and/or QR code.
3. Sends to target contacts (from a downloaded database of numbers or names).
4. Automatically collects data entered by victims (logins, passwords, session cookies, files).

This infrastructure is called “phishing as a service” (PhaaS) and is actively sold on the darknet.

3.2 Software tools (Telethon / Pyrogram)​

Bots are created in Python using powerful frameworks like Telethon or Pyrogram. Here's a sample code snippet (for training purposes) that illustrates the mechanics:

from pyrogram import Client, filters

app = Client("my_bot", api_id=12345, api_hash="...")

@app.on_message(filters.command("start") & filters.private)
async def start_command(client, message):
await message.reply("Welcome! Your session: #" + str(message.chat.id))

@app.on_message(filters.text & filters.private)
async def catch_creds(client, message):
if "@" in message.text: # primitive email detector
await message.reply("Data received ✅")
with open("stolen_logs.txt", "a") as f:
f.write(f"{message.chat.id}:{message.text}\n")

The bot can operate either on behalf of a regular user (user session) or on behalf of the official bot (bot token).

3.3. Bulk Mailing: Spambots and Session Rotation​

Account pools and ready-made botnets (for example, Telethon + Pyrogram) are used for mass mailings. The configuration includes a config.ini file with an array of accounts (api_id, api_hash, phone number). When sending a message, the code cycles through the accounts, distributing the load. This circumvents Telegram's default message frequency limits: one account can only send 20-30 messages per minute.

Part 4. Evilginx3 in conjunction with a Telegram bot: session hijacking and 2FA bypass​

Password phishing is a thing of the past. The main goal is to steal session cookies.

4.1 How Evilginx3 Works​

Evilginx3 is a reverse-proxy MITM framework. You create a fake domain (e.g., google.com-secure-login.ru) and configure Evilginx3 to proxy traffic to a real website (e.g., Gmail). The victim doesn't notice the difference and enters their username, password, and 2FA code.

Evilginx3 intercepts not only the password but also the session cookie. This cookie can then be imported into your browser — and you're logged in, 2FA is complete. A prepared phishlet (a configuration for a specific website) tells the system which parameters to intercept.

4.2. Telegram bot as a carder's frontend​

The attacker doesn't need to enter domains or manage the server themselves — the Telegram bot handles everything. Simply give the command "launch a Gmail campaign," and the bot will deploy a subdomain, generate a phishing link, send it to the victims, and, after hijacking the session, send a notification to Telegram with a pre-populated cookie.

4.3. Real Case: UNC1069 and Fake Zoom Conferences​

The UNC1069 group used a scheme to attack the cryptocurrency sector: a hacked Telegram account, an invitation to a Zoom meeting, and a link (leading to Evilginx3). The meeting, ostensibly with the CEO or partner, was then accompanied by an AI-generated video that convinced the victim to log into the crypto exchange account for "verification." The carders hijacked the session and withdrew funds.

Part 5. New Threat 2027: Fake Telegram Mini Apps for Wallet Theft and QR Codes​

A new vector is phishing via Telegram Mini Apps (TMA). In 2026, the FEMITBOT network was discovered, using TMA to launch fake crypto exchanges and apps. These mini apps ask victims to "connect their wallet," which in reality drains all funds and infects the phone with a trojan.

In a campaign against Trust Wallet, carders sent QR codes via Telegram that led to Netlify pages mimicking the USDT transfer interface. They exploited the ERC-20 approve() vulnerability: the victim signed a transaction to "verify USDT," but in reality, they were granting unlimited permission to withdraw funds to the carders' address.

The QR code attack process:

1. The victim scans the QR code.
2. A fake Trust Wallet app opens, asking for confirmation.
3. If the victim signs the transaction, all funds in the wallet go to the attacker's address.

Part 6. Ecosystem: Account Selling and Session Hijacking​

Stolen Telegram accounts are a valuable commodity. By hacking one account, a carder gains access to contacts and groups, creating a domino effect.

The main attack vector in 2026 is the theft of session files (tdata). A copy of the tdata folder from a victim's computer allows access to their Telegram account without a password or 2FA. The resulting access is sold on darknet forums. Infection via stealer logs (RedLine, Raccoon) allows this data to be collected and resold. The widespread use of these leaks has led to the industrialization of session theft.

Tools for automating sales and bypassing 2FA are also available on the darknet and Telegram.

Part 7. How Telegram Fights Bots (and How We Avoid Them)​

• API limits. The bot cannot send messages more frequently than a certain frequency. We use account rotation and load balancing via Python frameworks.
• Automatic bot detection. Telegram analyzes behavior. To mask bot activity, we add random delays and unique messages. We don't use a single bot en masse; we rotate accounts.
• Blacklists (bans). An account that is reported, restricted, or blocked. We create hundreds of backup accounts, purchase them from SMS activators for mass mailings, and sacrifice the most aggressive ones. "Expendable" accounts last from a few days to a week.
• Captcha for suspicious activity. Some bots require captcha solving if used too frequently. We use services like 2captcha or CapSolver to automatically solve captchas.

Part 8. DeepPhish Toolkit and Infrastructure in 2027​

Tool	Purpose	Source
FraudGPT, WormGPT, KawaiiGPT	Content generation (letters, pages)	2
Evilginx3 + phishlets	MITM, 2FA bypass, session theft	4
Darcula PhaaS	Managing a campaign via a Telegram bot	2
Pyrogram / Telethon	Python frameworks for automation	3
QR code for drainers (Trust Wallet)	Token theft via approve()	5
FEMITBOT network	Telegram Mini Apps for Crypto Scams	5

Part 9. OPSEC and the Final Carder Checklist​

1. AI generation. Use FraudGPT/WormGPT or the jailbroken ChatGPT to create personalized emails. Carefully customize the prompts.
2. Infrastructure. Run Evilginx3 on a VPS using crypto, set up phishlets for target services. Use temporary domains.
3. Telegram bot. Develop a bot to collect data. The bot should accept cookies and passwords and store them encrypted.
4. Mass mailing. Use a pool of Telegram accounts via Telethon/Pyrogram. Rotate accounts, maintain pauses.
5. QR code phishing for crypto. To steal USDT, set up a drainer page and distribute the QR code through channels.
6. Analysis and logging. Store everything collected in an encrypted database.
7. Camouflage. Use residential proxies, change your User Agent. Don't run bots from a single IP address.
8. Protect bots from bans. Add random delays and avoid duplicating templates. Rotate numbers and sessions. Use official Telegram documentation for legitimate actions to avoid attracting attention.

Summary​

DeepPhish is the evolution of phishing. AI is destroying the last remaining advantage of security — the human ability to detect deception. Telegram bots make attacks cheap and scalable. Evilginx3 and QR code drainers turn 2FA and biometrics into a formality. And easy access to stolen sessions completes the theft. In 2027, phishing is no longer just raw emails, but a fully automated industry. And Telegram has become its main arena.

A quick one-line reminder:
"The Telegram bot generates a page using Evilginx3. The victim enters their password and 2FA. You receive a session. The crypto wallet balance goes to approve(). Welcome to 2027."