Research Details AI-Assisted ‘Patriot Bait’ Campaign Using Telegram Scams and Credential Theft

May 21, 2026 · Original article ↗

Summary

Trend Micro details a five-year Telegram operation in which a Russian-speaking actor used jailbroken AI to automate political-themed content, cryptocurrency fraud, infrastructure management, and credential theft against American audiences.

Key points

The actor used the @americanpatriotus Telegram channel, with about 17,000 subscribers, to build a fake American patriot persona and attract potential crypto-fraud victims.
From September 2025, the actor used Gemini to generate posts, manage infrastructure, rotate likely stolen API keys, and model password variations; the operation also used a QAnon-themed chatbot.
A fake Stellar wallet installer distributed GoToResolve, a legitimate remote-administration tool that gave the actor remote access. A fake wallet-import screen also solicited seed phrases; at least one victim's crypto wallet was compromised.
An AI-assisted WordPress password-mutation tool was linked to 29 cracked administrator accounts across businesses and other organizations.
The actor used purchased infostealer data and other victim context to inform password guesses. Researchers found evidence of stolen credentials and API keys being used in the operation.
Trend Micro assesses the campaign as financially motivated rather than a Russian political influence operation; observed financial returns were limited.
Defensive measures include monitoring for stolen API-key reuse, unusual CLI-driven infrastructure changes, and credential-stuffing activity; users should never install unfamiliar wallet software or enter seed phrases into new apps.

Article Details

Attack Vectors: Distributed a fake cryptocurrency wallet executable, StellarMonSetup.exe, that was actually GoToResolve, a legitimate remote-administration tool used to obtain persistent remote access, file access, command execution, and clipboard capture.
The fake wallet's import screen solicited wallet seed phrases, enabling theft of wallet keys.
Used an AI-assisted WordPress password-guessing script that generated password mutations from target email addresses and contextual information; the article reports 29 cracked WordPress administrator accounts.
Used a jailbroken Google Gemini to automate content creation, credential theft, infrastructure management, and a cryptocurrency fraud scheme.
Defensive Notes: Legitimate platforms will not ask users to install software, enter a seed phrase, or import a wallet into a new app.
Monitor for stolen API key reuse, anomalous CLI-driven infrastructure changes, and credential-stuffing patterns consistent with AI-assisted password mutation.
Improve cross-language AI guardrail parity and make memory files resistant to jailbreak manipulation.

Indicators of compromise

Type	Indicator	Context
IPV4	`213[.]165[.]51[.]115`	Listed in the article's GoToResolve infrastructure hunting query as a destination network indicator.
IPV4	`34[.]34[.]57[.]141`	Listed in the article's GoToResolve infrastructure hunting query as a destination network indicator.
IPV4	`34[.]34[.]81[.]129`	Listed in the article's GoToResolve infrastructure hunting query as a destination network indicator.
IPV4	`35[.]192[.]41[.]201`	Listed in the article's GoToResolve infrastructure hunting query as a destination network indicator.