BOBAFFS Reports Fake-Invoice Attack Using Impersonated Telegram Accounts

BOBAFFS has reported an attempted malware attack in which fraudsters used fake Telegram accounts impersonating its CEO and a representative of advertiser Cwinz.

According to the team’s account, the attackers created a group chat to reconcile invoices and claimed to have discovered billing errors. They then sent a ZIP archive containing an executable .exe file instead of ordinary invoice documents.

Fake CEO Pressured Employee to Open File

A BOBAFFS business development employee questioned the archive and requested the documents in another format.

The account posing as the company’s CEO supported the request to open it, saying: “Open it, I take full responsibility.”

That intervention added apparent managerial approval to the supposed advertiser’s instructions. Both identities were allegedly controlled by the attackers; the account does not suggest that the genuine CEO or Cwinz representative participated.

When the employee said the file would not open on macOS, the attackers urged her to find a Windows computer and run it there. The team said the deception was ultimately uncovered.

No Confirmed Compromise Reported

BOBAFFS described the incident as an attempt to infect the employee’s computer. The supplied account does not report a successful infection, stolen information or financial losses, and does not identify the executable’s specific capabilities.

The case illustrates how a routine commercial task can become a pretext for requesting software execution, reinforced by several apparently familiar participants in the same conversation.

BOBAFFS advised employees to verify unusual requests through a previously trusted account or a call. Familiar names and profile pictures in Telegram, it noted, do not establish that a message comes from the real colleague or partner.