Phishing Campaign Abuses Browser Permissions to Harvest Victim Data
Summary
Cyble researchers describe a phishing framework hosted mainly on edgeone[.]app that uses browser-permission prompts to collect images, audio, video, device data and selected contacts, then sends data via Telegram bots. Script annotations suggest—but do not prove—AI use.
Key points
- Cyble researchers report phishing templates hosted primarily on edgeone[.]app that impersonate services including TikTok, Telegram, Instagram and Google.
- After a user grants browser permissions, scripts can capture camera images and record audio or video; the article also describes attempts to access selected contacts.
- The scripts fingerprint devices using browser APIs and collect public IP and approximate location data through external services.
- Captured media and telemetry are sent to attacker-controlled Telegram bots via the Telegram Bot API, avoiding the need for a dedicated backend.
- Researchers cite structured annotations and emoji-formatted messages as possible signs of AI-assisted script development; this remains an indication, not proof.
- The article recommends restricting camera access for unknown sites, monitoring browser-originated traffic to api.telegram.org, and using phishing detection and domain monitoring.
Article Details
- Attack Vectors
- Phishing pages hosted on edgeone.app use lures such as ID Scanner, Telegram ID Freezing, and Health Fund AI, and impersonate consumer platforms and services.
- Pages prompt victims to grant camera, microphone, or contact access under the pretext of verification or service recovery.
- Client-side scripts capture camera images and record video and audio, enumerate device information, and attempt to access selected contacts through the Contacts Picker API.
- Scripts retrieve public IP and approximate geolocation information, then transmit collected data to Telegram bots through the Telegram Bot API.
- Defensive Notes
- Restrict camera permissions for unknown websites.
- Monitor outbound traffic to api.telegram.org when it originates from browser sessions.
- Deploy browser security extensions capable of identifying phishing pages.
- Monitor domains hosting suspicious phishing kits.
MITRE ATT&CK
T1082 · System Information DiscoveryScripts collect device and system metadata using browser properties including userAgent, platform, deviceMemory, and hardwareConcurrency.T1119 · Automated CollectionThe scripts automate collection of device telemetry and, when permitted, images, recordings, and selected contact details.T1123 · Audio CaptureCampaign scripts request microphone access and record audio from victims' devices.T1125 · Video CaptureAfter camera permission is granted, campaign scripts capture still images and record video from victims' devices.T1566 · PhishingThe campaign uses phishing pages and social-engineering lures, including fake verification and service-recovery workflows.T1567 · Exfiltration Over Web ServiceCollected media and telemetry are transmitted through the Telegram Bot API as an exfiltration channel.
Products
EdgeOne PagesInfrastructure: Extensive use of edgeone.app (EdgeOne Pages) for hosting low-cost, scalable, and highly available phishing landing pages.Flappy BirdCampaign hosted primarily on edgeone.app using templated phishing pages to impersonate consumer platforms (TikTok, Telegram, Instagram, Google/Chrome, Flappy Bird).Google ChromeCampaign hosted primarily on edgeone.app using templated phishing pages to impersonate consumer platforms (TikTok, Telegram, Instagram, Google/Chrome, Flappy Bird).Google DriveThe phishing pages impersonate popular platforms and services, including TikTok, Telegram, Instagram, Chrome/Google Drive, and game-themed lures such as Flappy Bird, to increase victim trust.InstagramCampaign hosted primarily on edgeone.app using templated phishing pages to impersonate consumer platforms (TikTok, Telegram, Instagram, Google/Chrome, Flappy Bird).TelegramCampaign hosted primarily on edgeone.app using templated phishing pages to impersonate consumer platforms (TikTok, Telegram, Instagram, Google/Chrome, Flappy Bird).TikTokCampaign hosted primarily on edgeone.app using templated phishing pages to impersonate consumer platforms (TikTok, Telegram, Instagram, Google/Chrome, Flappy Bird).