How malicious links work in Telegram

Malicious links disguised as gifts are circulating in Telegram. Clicking them leads to account suspension.

Attack Mechanism

Threat actors send a link mimicking a gift. Upon clicking, a chat with a stranger opens with a pre-filled message text.

Sending this text to the scammers triggers an immediate profile freeze for the user.

Signs of Threat

Malicious links always start with the tg://msg_url prefix.

• Do not click suspicious links from unknown senders
• Check the URL structure before clicking
• Be cautious with offers to receive a 'gift'

Remember: sending a pre-prepared text in a chat with a stranger is the trigger for your account to be blocked by the platform.