Analysts have identified fraudulent bots in Telegram with an Easter theme

Scammers have created Telegram bots that use Easter themes for phishing, account hijacking, and investment advertising. They offer to receive a gift or a prize if they subscribe to certain channels in the messenger. This was reported to Izvestia by F6 (a developer of technologies to combat cybercrime) on April 18.

Analysts have found at least 11 bots that use holiday themes to deceive users. The typical name of such bots is "Easter Eggs", and their accounts also use words similar to the word "Easter".

Fraudulent bots offer to receive a holiday gift, a prize, or a Premium subscription on behalf of Telegram, Roblox, or a popular marketplace. Under this pretext, the user is asked to indicate their age and wait 48 hours for the "manager" to contact them, who will provide details, or the "Easter egg" will appear in the game account.

A subscription to certain channels of "sponsors" in the messenger is indicated as a prerequisite for receiving a gift. In almost all cases, such channels are used to advertise investment fraud. At the same time, one of the bots is designed to hijack accounts: it asks you to share your contact, and then the authorization code.

Code in a bag: Russians are massively deceived using QR

Scammers use new ways to commit crimes

Experts clarified that all bots that use the Easter theme for deception were created recently, they have already been used by more than 120 thousand users. The pre-Easter attack is aimed not only at adults, but also at children: this is indicated by the offer of individual bots to receive a gift in the Roblox game. To advertise Easter Egg bots, attackers use Reels on Instagram (owned by Meta, which is recognized as extremist and banned in the Russian Federation) and videos on TikTok. The links in the accounts distributing these videos lead to Telegram channels, from where the user is redirected to specific bots.

"For the first time, we have documented the use of Easter symbols in fraudulent schemes on the Internet. There are no moral boundaries for cybercriminals. Every popular holiday, even a religious one, is just another reason for them to create new and change old deception scenarios. In 2025, attackers are actively creating new situational pretexts for fraud. Last winter, they used visual images of Carnival for the first time, creating websites to advertise an investment campaign, and now they have reached Easter," said Evgeny Egorov, a leading analyst at F6's Digital Risk Protection department.

Earlier, on April 17, the Department for combating the illegal use of information and communication technologies of the Ministry of Internal Affairs of the Russian Federation reported that scammers were calling Russians, posing as law enforcement officers or government officials, and asking them to register on a certain resource. They then suggest enabling a screen demonstration to simplify the process. As a result, fraudsters gain access to personal data and restore access to their account on Gosuslugi.