How my Telegram account was stolen through a fake meeting link

My Telegram account was stolen through a fake video call link: two letters in the address had been swapped, so instead of microsoft teams it read miclosoft teams. A process wrote itself into the system in a fraction of a second, sat there for about ten days and waited until I typed a two-factor code. No antivirus ever flagged it. I got the account back, took the scheme apart, and here it is in full.

How the scheme works

I booked the call myself, with a partner whose own account, as it turned out later, had been taken exactly the same way. The attackers clone his booking page, you arrive through the familiar address and check nothing, because the initiative was yours.

On the call itself, the other side’s camera “is not working”. They ask you to fix a driver: open a page, download a file, paste a command into the terminal. That is the moment it happens.

Why it worked on me

Three details build the trust, and every one of them is forged.

First, I scheduled the meeting. Your brain does not inspect a link you followed yourself. Suspicion switches on for incoming links, not for your own.

Second, there was live video of someone I know. It had been recorded while he was being hacked. You see your partner’s face and stop doubting.

Third, the request sounds technical and small. Not “send money”, but “help me, my camera died”. It is a request for help, and refusing feels rude.

What the antivirus missed

The second antivirus caught the phishing app immediately. The implanted process, though, was invisible to every scanner I ran. What found it was the agentic tool in my terminal that I use for work: it walked the system, listed three processes, resolved the addresses they were calling home to, isolated them and deleted them. Using the same data I drafted a police report in Spanish.

I am not claiming this is how it goes for everyone, it is one case, mine. But the lesson is simple: when you suspect something, a scanner is not a replacement for inspecting the system, it runs alongside it.

Red flags during a call

What happens	What it means
You are asked to paste a command into the terminal	Stop, this is almost always a takeover
You are asked to download a file or open a page to “fix” a driver	Stop
The other side’s camera or microphone suddenly fails	Offer to reschedule
You are rushed, because otherwise there is no time to cover everything	Time pressure is part of the scheme

The correct reaction is identical in all four cases: leave and reschedule. A legitimate counterpart does not take offence at that.

What to do before a call

Send your own link, from your own booking page. Then there is nothing to verify.

If someone sends you a link, paste it into a chat with a language model and ask whether it is safe. Your eye does not catch two swapped letters in a domain, while a model compares the string character by character.

Turn on two-factor verification everywhere, and where possible on independent channels: an authenticator app plus a fingerprint or face, rather than one mailbox guarding everything.

The prompt I use to check my machine

I run this check once a week. The prompt is written for macOS; for Windows, ask the model to rewrite it for your system.

Copy the whole text and hand it to an agent with terminal access (Claude Code, Codex).

You are a security auditor doing a threat hunt on this macOS machine. Assume nothing:
this machine MAY BE COMPLETELY CLEAN, and "no threat found" is a valid, expected result.
Do not invent a problem to justify action. Your job is to (1) surface anything suspicious
or anomalous, (2) explain each finding so I understand it, and (3) be ready to neutralise
ONLY if something real is confirmed and ONLY after I approve.

GROUND RULES
- The whole hunt is READ-ONLY. Do not delete, kill, move, or modify anything.
- Distinguish clearly between "normal", "needs a human glance", and "actually malicious".
  Most machines have lots of the first two. Do not raise alarms on legitimate software.
- Hunt by behaviour and anomaly, not a fixed list. Treat as worth checking:
  code running from user-writable paths (~/Library, /tmp, /var/folders, /Users/Shared),
  unsigned / adhoc / non-notarized binaries that have persistence or network access,
  LaunchAgents whose label impersonates a trusted brand (com.apple.* over a third-party
  name like 1Password/Google/CleanMyMac), persistence that launches an interpreter
  (bash/python/osascript) with -c / base64 / curl / eval, established connections to raw
  public IPs with no reverse DNS on odd ports by non-browser processes, several artifacts
  created in the same minute, and recently cleared shell history.

PHASE 1 - COLLECT (read-only). Report what you see at each step, good or empty.
1. Shell history (~/.zsh_history, ~/.bash_history): curl|wget piped to a shell, chmod +x
   in temp, nohup, tput reset, base64 -d | sh, osascript -e, suspicious TLDs
   (.online/.xyz/.top/.shop), any download-and-run one-liners.
2. Persistence: ~/Library/LaunchAgents, /Library/LaunchAgents, /Library/LaunchDaemons.
   Print Label + ProgramArguments + RunAtLoad/KeepAlive + mtime. Flag brand-impersonating
   labels, interpreter launches, and binaries living in user-writable paths.
3. ~/Library/Application Support: flag any com.apple.* folder that contains a Mach-O binary.
4. Processes running from /tmp, /var/folders, /Users/Shared, or fake Application Support
   paths (ps + executable path). Note that AppTranslocation is often a legit quarantined app.
5. Live network: lsof -nP -iTCP -sTCP:ESTABLISHED. Flag established connections to raw public
   IPs (no rDNS) on unusual ports by non-browser processes. Ignore LAN/private/loopback IPs.
6. Other vectors: login/logout hooks (com.apple.loginwindow), cron / at / periodic / emond,
   configuration profiles (profiles list), system/kernel extensions, DYLD_INSERT_LIBRARIES
   in shell env files and launchd EnvironmentVariables, /etc/hosts redirects of sensitive
   domains, proxy (scutil --proxy), DNS overrides, ~/.ssh/authorized_keys, new admin users
   (dscl . -read /Groups/admin), sudoers / sudoers.d, injected lines in shell rc files, GUI
   login items, browser extensions (especially crypto wallets and broad-permission ones).

PHASE 2 - VERIFY each non-obvious item.
- codesign -dv --verbose=4 <path> and spctl --assess --type execute -v <path>.
- shasum -a 256 <path> for any suspect binary (record the hash).
- Trace the parent process and what the binary connects to.
- Give each item a verdict: legitimate / needs-review / malicious, with your reasoning.
- One known campaign to also check for (an EXAMPLE, do not limit to it; absence means nothing):
  domain webcamsdk-update.online ; C2 172.86.126.215 ; files teamsSDK.sh / teamsSDK.bin ;
  fake LaunchAgents com.apple.1Password / com.apple.CleanMyMac / com.apple.Google.

PHASE 3 - REPORT (always). Give a clear overall verdict:
  CLEAN          - nothing malicious found (list the few review items as a sanity check),
  NEEDS REVIEW   - ambiguous items I should confirm, none clearly malicious yet,
  COMPROMISED    - confirmed malicious persistence/process/connection (list evidence).
Be honest. If it is clean, say so plainly and stop. Do not proceed to Phase 4.

PHASE 4 - PREPARE CONTAINMENT (only if Phase 3 = COMPROMISED, and only after I approve
each item). Do not act unprompted.

- First write all evidence to a file: plist contents, hashes, paths, C2 IPs, process list.
- Then propose exact, reversible steps: quarantine (move, NOT delete) to
  ~/quarantine_malware_<date>/, unload the LaunchAgents/Daemons (launchctl bootout), kill
  the live process. Show me the commands and wait for my go-ahead before running them.
- After I approve and you run them, re-check: confirm no malware process and no C2 connection.

PHASE 5 - ADVISE (always, scaled to what you found).
- If COMPROMISED: list every credential/secret to rotate from a CLEAN device (password
  manager, browser passwords, crypto wallets/seeds, .env API keys, SSH keys, email,
  exchanges), tell me to check the mailbox for attacker forwarding rules, and state plainly
  that after an interactive backdoor the only certain cleanup is a full macOS reinstall.
- If CLEAN or NEEDS REVIEW: give short hardening tips (hardware/app 2FA not SMS, do not run
  commands sent during calls, keep seeds off the work machine) and what to glance at manually
  (System Settings > Privacy > Accessibility / Input Monitoring / Screen Recording, which a
  keylogger would need and which this hunt cannot fully read without Full Disk Access).

Start with Phase 1 now and report findings as you go. Remember: finding nothing is a good
and valid outcome. Do not delete or change anything without my explicit approval.

Three things in this prompt matter more than the rest.

The whole hunt is read-only. An agent that deletes what it finds takes the evidence with it, and sometimes working parts of your system too. It only proposes containment after you approve, and it quarantines rather than deletes.

“Found nothing” is a valid result. That is stated in the opening paragraph and repeated at the end. Without it, a model will almost always “find” something rather than return an empty answer.

It hunts by behaviour, not by a fixed list. The specific campaign with the webcamsdk-update.online domain and the brand-impersonating launch agents is given as an example, not as the full list: its absence proves nothing.

What to do if it already happened

The order is this. Run a system scan first. In parallel, go through running processes and network connections, because that is where the thing your scanner cannot see is hiding. Then reset every password, not just the one that was taken. On a confirmed intrusion, reinstalling the system from scratch is the safer call: there is no guarantee you cleaned out everything.

One more thing. After a takeover, what your friends receive from your account is not extortion. They get normal business conversations, trained on your own message history, followed by an invitation to a call. The goal is not your money, it is the next set of accounts. The scheme spreads like a virus, which is why your circle has to be warned within the first hour.

What saved the work perimeter

They never reached the corporate infrastructure, and the reason is boring: two-factor and three-factor verification from separate devices, the whole perimeter behind a VPN, access split by role. For most people the personal perimeter is weaker than the work one, and the personal one is exactly what gets attacked, because it is the easier route to everything else.

If you remember only one thing

Being asked to paste something into a terminal or download something during a video call is not a technical glitch. It is the attack. At that moment the meeting ends, it does not continue.