TRAP10 Mini App Scam

Overview:

CTM360 has discovered a new variation of scam tactics using Telegram Mini Apps and social media ads in a Ponzi-style scheme. Scammers impersonate financial institutions, leveraging Meta Ads, Telegram Ads, and fake social media accounts to lure victims into fraudulent investment platforms.

These platforms, embedded within Telegram, present a polished interface that mimics legitimate trading sites. Victims are enticed with promises of high returns, referral bonuses, and exclusive investment opportunities. Once inside, they are encouraged to deposit cryptocurrency, believing they are engaging in real trading. However, withdrawals are consistently blocked when users attempt to cash out.

CTM360 Observations

Resource Development

Telegram Mini App

• A Mini App in Telegram is a lightweight web application that runs within the Telegram interface, allowing users to interact with services like payments, games, or trading platforms without leaving the app.
• Scammers embed these fake websites inside Telegram Mini Apps, making them accessible within Telegram itself.
• Users interact with the fake platform through Telegram bots keeping them within the scam ecosystem.

Scammers also create fake websites with dedicated domains that mimic real platforms, solely for fraudulent trading, deposits, and referral scams.

‍

‍

‍

Trigger

Scammers lure victims with false promises of high, risk-free returns, financial incentives like bonuses and referral rewards, and fake branding to appear credible. They create urgency with limited-time offers and countdowns to pressure quick investments.

Distribution

Scammers spread the fraud across multiple platforms:

• Meta & Telegram Ads – Paid ads and channels drive users to fake trading platforms.
• Telegram Bots & Channels – Used to lure victims into scam sites and mini-apps.
• Social Media & Messaging Apps – Victims unknowingly spread the scam by inviting friends for bonuses.

By using ads, fake profiles, and victim referrals, scammers rapidly expand their reach.

‍

Target Interaction

Impersonated and Bogus Profiles

• Fake social media accounts are created to promote, manage and provide fake customer service to the victims
• We have also noticed scammers impersonating financial institutions, investment platforms and other industry organizations on Telegram to lure victims.

Impersonated or Bogus Websites embedded within Telegram Mini App

• The scam operates within a Telegram Mini App, where victims are redirected to the fake investment website.
• The Mini App will retrieve victim’s Telegram  details  and allow them  quick access on these fake websites without sign-up. 
• Upon sign-up,  victims are requested to deposit funds and trade but withdrawals are blocked.

Motive

• PII Harvesting – Scammers collects your email address, phone number, Telegram IDs during the sign up process. 

Monetization

• Payments to Cryptocurrency Wallets – Victims are tricked into transferring funds via cryptocurrency (e.g., USDT, BNB, TRX) to scam-controlled wallets.
  ‍
• Selling Data on the Dark Web – The stolen credentials, Telegram IDs, emails, and phone numbers can likely be sold on underground forums or leveraged for future cyber criminal activities

Recommendations

For Individuals:

• Avoid Telegram Mini Apps for Trading – Scammers use them to bypass security measures.
• Verify Websites & Domains – Always check official sources before engaging in financial transactions.
• Use 2FA on All Accounts – Protect Telegram and crypto wallets from unauthorized access.‍
• Never transfer funds to an account without verifying the purpose and recipient independently.

‍For Businesses:

• Scan social media, Telegram, and ad networks for scams related to your brand and report them accordingly. 
• Work with platforms to remove and takedown fraudulent sites.
• Educate and warn users on common fraud schemes.

‍

Disclaimer

The information contained in this document is meant to provide general guidance and brief information to the intended recipient pertaining to the incident and recommended action. Therefore, this information is provided "as is" without warranties of any kind, express or implied, including accuracy, timeliness, and completeness. Consequently, under NO condition shall CTM360®, its related partners, directors, principals, agents, or employees be liable for any direct, indirect, accidental, special, exemplary, punitive, consequential, or other damages or claims whatsoever including, but not limited to: loss of data, loss in profits/business, network disruption…etc., arising out of or in connection with this advisory.

For more information:

Email: monitor@ctm360.com Tel: (+973) 77 360 360

‍

‍