Scammers Launch Fake Cyberpolice Russia Telegram Bot to Steal Accounts and Sell Fake Subscriptions
Fraudsters have created a counterfeit Telegram bot operating under the name of Cyberpolice Russia. The fake account uses official symbols and a plausible legend to appear legitimate while pursuing the classic goal of obtaining money or hijacking user accounts.
One scenario involves offering users a paid subscription for protection against cyber threats. The attackers appear to have decided that ordinary antivirus software was insufficient and are now selling protection from threats they themselves create.
In the second scenario the bot asks the victim to provide a six-digit confirmation code. Once the code is received, the fraudsters gain access to the user's Telegram account. Such codes must never be shared with third parties, including real support services or law-enforcement agencies.
Cyberpolice Russia has reiterated that units of the Russian Ministry of Internal Affairs do not offer paid services for informing citizens about cyber threats. Any proposal to purchase a subscription, protection, or special alerts from the agency should be immediately blocked.
The official Telegram bot of Cyberpolice Russia is available at the exact handle cyberpolicerus_bot. Users are urged to check the name carefully, as scammers often substitute letters or insert symbols hoping the difference will go unnoticed. The core safety rule remains unchanged: six-digit codes must never be disclosed to anyone, regardless of how convincing the avatar or emblem appears.
Related articles
Positive Technologies Uncovers Disinformation Factory Linking 45 Domains and 74 Telegram Channels
Researchers at Positive Technologies have exposed an integrated disinformation operation that combined fake government emails with a network of pseudo-news websites and synchronized social media channels. The campaign began with emails sent from lookalike domains such as minpromtorg.digital and gosuslugi.digital, requesting employee lists and salary data to prepare targeted phishing attacks. Parallel to the email activity, operators maintained at least 45 domains including rulenta.live and crime24.live that mixed genuine stories with fabricated content and cited nonexistent sources. These sites were amplified through dozens of Telegram channels and accounts on VKontakte, Odnoklassniki, YouTube, Instagram, and TikTok, creating a self-reinforcing loop where fabricated claims were quoted back as credible reporting. Investigators noted a possible infrastructure overlap with the cybercriminal group Rare Werewolf, although direct attribution remains unconfirmed. The operation demonstrates a complete information pipeline from initial reconnaissance via email to wide distribution of disinformation across multiple platforms.
Russian Interior Ministry Advises Citizens Against Posting Personal Dossiers on Social Media
The Russian Ministry of Internal Affairs has issued a public warning urging citizens to reduce the amount of personal information shared on social networks. Details such as places of study and work, home addresses, and family information should remain outside public profiles to avoid attracting the attention of fraudsters and recruiters. According to materials cited by RIA Novosti, such digital self-portraits allow malicious actors to study potential victims, identify vulnerabilities, and craft personalized communication scenarios. The ministry also recommends avoiding public discussions of personal views and refraining from answering questions from strangers. Users are advised to verify profile ownership before engaging and to block suspicious accounts while reporting them to platform moderators. This marks the second such advisory from the ministry within recent months, following an October 2025 reminder about the risks of exposing full names, birth dates, and other identifiable data.
Cordial Spider Deploys Work Panel Platform for Tech Support Scams Against Corporate Identities
A criminal platform called Work Panel is turning fake technical support calls into structured operations aimed at taking over corporate accounts. The service combines target research, page cloning, telephony, and credential capture within a single control panel. It is linked to the group tracked as O-UNC-045, also known as Cordial Spider. Campaigns target users of multiple identity providers and combine telephone social engineering with fake authentication pages. Operators research names, job titles, corporate emails, phone numbers, and professional profiles before calling to impersonate help-desk staff. While one operator keeps the victim on the line, a manager monitors the phishing session in real time. Captured credentials are sent only to operation managers via Telegram, reducing internal theft risks among the criminals themselves.
Scammers Deploy Fake Russian Defense Ministry Websites to Harvest Data from Relatives of Fallen Soldiers
Russian threat intelligence firm F6 has uncovered a phishing campaign that used counterfeit Ministry of Defense portals to target relatives of participants in the special military operation. The attackers registered lookalike domains and populated them with official logos, coats of arms, and navigation menus copied from the legitimate mil.ru site, leaving only the registration form under their control. Victims were invited to register for state awards ceremonies and asked to supply full name, phone number, passport details, SNILS, and INN; an additional “Add guest” button collected the same information for accompanying persons. The stolen data can be used to reset access to government services, apply for microloans, or launch follow-on social-engineering attacks against military families. F6 analysts noted that the fraudulent pages were likely generated with a large language model, evidenced by an unhandled JSON error that appeared only after data submission. Although the discovered domains have been blocked inside Russia, the low technical barrier means new clones can be stood up quickly.