Hijacking Control via Internal WebApp Tokens
Modern trap bots mimic clickers, dating services, or crypto giveaways by opening third-party web pages inside the messenger. Fraudulent scripts try to get initData and phone numbers, or show wallet connection forms that sign balance-draining transactions (drainers).
Rules for Interacting with Messenger Bots
- set a strong two-step cloud password in account privacy settings
- never enter auth verification codes inside mini apps opened by bots
- check the address of opening sites in the WebApp header bar before confirming rights
- block bots that require sending contacts or subscribing to sketchy channels to launch