In short: Security experts are warning of a two-stage attack on messaging app users: first, criminals steal a Telegram account through a fake built-in mini-app; then they download stored voice messages and use AI to clone the victim's voice, sending fake audio to all contacts with urgent money requests. Izvestia reported the scheme on September 2, 2026, citing Kaspersky Lab experts.
Stage one: how accounts are stolen via mini-apps
The attack begins with a message in a large Telegram group chat. Attackers, posing as the group admin, announce the chat is moving to a new platform due to a "hack" or "block," and invite members to click a link. That link opens a built-in mini-app — a small web interface embedded inside Telegram — displaying a field requesting a verification code.
The user believes they are entering a CAPTCHA or a routine verification step. In reality, it is Telegram's five-digit login code — the one the app sends when a new device attempts to sign in. By submitting it, the victim effectively adds the attacker's device to their account. Without a cloud password (two-step verification) enabled, the takeover is immediate.
The critical danger of this scheme is that it requires no external phishing site. Everything happens inside Telegram, creating an aura of legitimacy that bypasses most users' instincts and standard anti-phishing filters. According to Anti-Malware.ru, attacks exploiting malicious Telegram mini-apps were first documented in January 2026. Kaspersky GReAT senior expert Sergei Golovanov noted that Telegram only reviews mini-apps after user complaints, not before they go live.
Stage two: AI clones the victim's voice to defraud contacts
Once inside the account, attackers do not immediately lock out the real owner — they need time first. Their opening move is to download every voice message stored in the victim's chats. Modern AI voice-synthesis tools need only a few seconds of audio to create a clone indistinguishable from the original in pitch, pace, and characteristic speech patterns.
With the cloned voice ready, attackers send generated audio messages to everyone in the victim's contact list. The content is predictably urgent: "Hey, I'm in a tough spot — can you transfer me a small amount? I'll pay you back tomorrow," or "I need help, something came up." The recipient hears a familiar voice and often sends money without a second thought.
This tactic is more effective than text-based fraud because voice is perceived as a near-irrefutable identity signal — recognizing a familiar voice suppresses critical thinking. That is exactly what criminals exploit: trust in sound, not in words. Learn more about protecting your data in messaging apps in the LiMP VPN blog.
How to protect your Telegram and WhatsApp account
A few settings that take only a couple of minutes and significantly reduce the risk:
- Enable Two-Step Verification (cloud password) in Telegram: Settings → Privacy and Security → Two-Step Verification. Even if an attacker intercepts your login code, they cannot sign in without this second password.
- Never enter your Telegram code anywhere outside the official app login screen. Mini-apps inside Telegram have no legitimate reason to request authorization codes — treat any such prompt as a definitive red flag.
- Review your active sessions regularly: Settings → Devices. Terminate any unfamiliar device immediately.
- Restrict who can add you to groups: Settings → Privacy → Groups and Channels → My Contacts Only.
- Avoid publishing voice recordings publicly. Even a short voice clip on open social media is raw material for AI voice cloning.
If you receive a voice message requesting money — even from a trusted contact — call them directly first to verify. LiMP VPN's features protect your network traffic at the OS level, but defending your messenger account from social engineering requires the app's own security settings, not a VPN.
What to do if your account is already compromised
Act immediately — you may have only minutes before attackers lock out your remaining devices:
- Sign into Telegram from a different device or via web.telegram.org.
- Go to Settings → Devices → Terminate all other sessions.
- Set a Two-Step Verification password immediately if you did not have one.
- Warn your contacts about the breach so they ignore any voice messages sent in your name.
- Contact Telegram support through the official website for account recovery.
If attackers have already changed the linked phone number, recovery requires identity verification through Telegram support — a slow process. Prevention matters far more than any possible recovery. LiMP VPN from $0.85/month encrypts your traffic end-to-end, but no VPN substitutes for proper account hygiene.