Telegram Mini Apps Exploited in 'Blitz' Crypto Scams and Android Malware Campaigns

---
title: Telegram Mini App Fraud - Network Connection to Suspicious Domains
id: 8a5f2c1e-9b4d-4e6f-a1c3-5d6e7f8a9b0c
status: experimental
description: Detects network connections to domains known to be used in the Telegram Mini App 'Blitz' crypto scam campaign, such as typo-squatted Notion domains.
references:
 - https://www.bleepingcomputer.com/news/security/telegram-mini-apps-abused-for-crypto-scams-android-malware-delivery/
author: Security Arsenal
date: 2024/05/24
tags:
 - attack.command_and_control
 - attack.t1071.001
logsource:
 category: network_connection
 product: windows
detection:
 selection:
 DestinationHostname|contains:
   - 'notion-site.com'
   - 'onlinemahalaxmi.com'
   - 'pascal-app'
 condition: selection
falsepositives:
 - Legitimate access to similarly named internal assets (unlikely given TLD)
level: high
---
title: Android Trojan - Suspicious Pascal Package Installation
id: 1b3c4d5e-6f78-90ab-cdef-1234567890ab
status: experimental
description: Detects the installation of the malicious 'Pascal' or 'Notion' impersonator Android APKs associated with the Telegram Mini App campaign.
references:
 - https://www.bleepingcomputer.com/news/security/telegram-mini-apps-abused-for-crypto-scams-android-malware-delivery/
author: Security Arsenal
date: 2024/05/24
tags:
 - attack.initial_access
 - attack.t1190
logsource:
 product: android
 definition: 'Package installation events'
detection:
 selection:
 PackageName|contains:
   - 'com.pascal.app'
   - 'com.notion.services'
   - 'com.notion.tools'
 Action: 'install'
 condition: selection
falsepositives:
 - Legitimate installation of the actual Notion app (com.notion.id)
level: critical

// Hunt for network connections to domains associated with Telegram Mini App fraud
// Look for connections to typo-squatted domains or known C2s
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("notion-site.com", "onlinemahalaxmi.com", "pascal-app", "telegram-mini-app-c2") 
   or RemoteUrl contains "@" and ActionType == "ConnectionSuccess"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, LocalPort
| extend FullURL = iff(RemoteUrl contains "@", strcat("https://", RemoteUrl), RemoteUrl)
| order by Timestamp desc


// Hunt for installation of suspicious Android packages on mobile endpoints managed by Defender
DeviceProcessEvents
| where Timestamp > ago(30d)
| where ActionType == "PackageInstall" 
| where InitiatingProcessFileName in~ ("com.android.packageinstaller", "com.google.android.packageinstaller")
| where FileName has_any ("pascal", "notion.services", "notion.tools") 
   and FileName !~ "com.notion.id" // Filter out legitimate Notion
| project Timestamp, DeviceName, AccountName, FileName, SHA256, InitiatingProcessAccountName

-- Hunt for active network connections to known malicious domains associated with the Blitz campaign
-- Note: Requires elevated privileges to view all connections
SELECT Timestamp, RemoteAddress, RemotePort, ProcessName, PID
FROM netstat()
-- Filter for connections to suspicious domains (resolved IPs or hostnames if available in cache)
WHERE RemoteAddress IN network_lookup("
    notion-site.com,
    onlinemahalaxmi.com,
    pascal-app.com
")
  OR RemoteAddress =~ "192.168\.." // Example: Exclude local LAN, focus on external specific C2s if known

<#
.SYNOPSIS
    Hardens the local hosts file against known Telegram Mini App scam domains.
.DESCRIPTION
    This script checks for specific malicious domains associated with the 'Blitz' campaign 
    and adds them to the Windows hosts file to prevent resolution and user connection.
#>

$MaliciousDomains = @(
    "notion-site.com",
    "onlinemahalaxmi.com",
    "www.notion-site.com"
)

$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
$RedirectIP = "0.0.0.0"

Write-Output "[*] Starting hardening of hosts file against Telegram Mini App IoCs..."

try {
    $CurrentHosts = Get-Content -Path $HostsPath -ErrorAction Stop
} catch {
    Write-Error "[-] Failed to read hosts file. Run as Administrator."
    exit
}

$ChangesMade = $false

foreach ($Domain in $MaliciousDomains) {
    $Entry = "$RedirectIP    $Domain"
    # Check if domain is already present
    if (-not ($CurrentHosts -match [regex]::Escape($Domain))) {
        Write-Output "[+] Blocking domain: $Domain"
        Add-Content -Path $HostsPath -Value $Entry
        $ChangesMade = $true
    } else {
        Write-Output "[!] Domain $Domain is already blocked."
    }
}

if ($ChangesMade) {
    Write-Output "[*] Successfully updated hosts file. Flushing DNS cache..."
    Clear-DnsClientCache
} else {
    Write-Output "[*] No changes were necessary."
}

Write-Output "[*] Hardening complete."