A sharp wave of mass Telegram account hijacking has been recorded in Uzbekistan. According to the Ministry of Internal Affairs Cybersecurity Center and the Tashkent City Main Directorate of Internal Affairs, cybercriminals are actively spreading phishing attacks under the guise of participating in fake 'contests' and 'votes'. Law enforcement agencies officially warned about this on October 30, 2026, urging citizens to show increased vigilance online. A particular danger lies in the fact that malicious messages do not come from unknown numbers, but from already hacked accounts of close acquaintances, friends, and family members, which significantly increases the victim's trust in the received link.
Five Steps to Losing Control of Your Account
The attack scheme described by cybersecurity specialists is built on the classic principle of social engineering and consists of five consecutive stages. At the first stage, the victim receives a 'sincere' request from an acquaintance: 'Hi, please click the link and vote for my nephew' or 'We are participating in a contest for the best mother/grandmother.' At the second stage, the link opens a fake page that completely mimics the design and interface of Telegram. The third step is a data request: under the guise of 'confirming the vote', the site asks to enter a phone number and a five-digit secret code sent by the Telegram app. The fourth stage happens instantly: as soon as the code is entered, scammers gain access to the account from another device and forcibly terminate all active sessions of the victim. At the fifth and final stage, new scam messages are sent to all contacts through the captured profile, or requests are made to loved ones to urgently transfer money to a card.
Why Victims Don't Notice the Catch
The key element of the attack's success is the use of trust. Since the message comes from a person the recipient trusts, critical thinking is turned off. The user perceives the request as a normal everyday situation: helping a relative vote for a child in a school contest or supporting a friend in a 'best grandmother contest'. The phishing page is visually indistinguishable from the official Telegram interface, eliminating visual markers of deception. This is why law enforcement emphasizes that the source of the link does not matter—only the link itself and the fact that it requires entering a confirmation code matter.
Three Rules of Digital Hygiene That Save an Account
The MIA Cybersecurity Center has formulated three basic protection rules. First: never click on suspicious links, even if they were sent by your closest relative. If the message concerns votes, gifts, or cash prizes, you must first call the sender by voice and clarify whether they actually sent this link. The second rule: under no circumstances give out the five-digit security code on any websites or to anyone. This code is confidential information equivalent to a password. The third and most technically significant rule is to immediately enable two-factor authentication (2FA). In the Telegram app, this is done via 'Settings' → 'Privacy and Security' → 'Two-Step Verification', where a complex password is set and an email address is linked. With 2FA enabled, even if the confirmation code is intercepted, the attacker will not be able to log into the account without the additional password.
What to Do If Your Account Is Already Compromised
If a user has already entered the code and discovered that the account has been hijacked, every second is critical. Experts recommend immediately terminating all active sessions: in the 'Settings' → 'Devices' section, delete all unknown devices from which access is maintained. Next, set a two-step password as soon as possible or initiate a temporary freeze of the account through Telegram support. The third mandatory step is to warn all close ones and contacts via voice call or alternative communication channels that the account has been hacked so they do not become the next victims of scam messages sent on behalf of the owner. The faster these actions are taken, the fewer contacts will be involved in the attack chain.
Official Position of Law Enforcement Agencies
The MIA Cybersecurity Center and the Tashkent Main Directorate of Internal Affairs urge all citizens of Uzbekistan to follow the rules of digital hygiene and actively warn their loved ones, especially elderly people, who most often become targets of such attacks. Law enforcement notes that the mass nature of the attack and the use of already compromised accounts to spread phishing links create a 'snowball' effect: each new victim account becomes a tool for capturing the next one. In this regard, the MIA recommends not only protecting your own profile, but also checking whether the accounts of close ones have been hacked and, if necessary, helping them regain control over their accounts.
