---
title: "Mass Telegram Account Hijacking in Uzbekistan: How Scammers Use Fake 'Votes' and 'Contests'"
description: "The MIA Cybersecurity Center of Uzbekistan warned about a massive hijacking of Telegram accounts through fake 'votes' and 'contests' sent on behalf of already hacked contacts. Specialists described the five-stage attack scheme and provided protection recommendations."
date: 2026-10-31T13:03:39.998Z
lang: en
url: https://xab.info/en/posts/mass-telegram-account-hijacking-uzbekistan
tags: [telegram, cybersecurity, phishing, uzbekistan, scam, account-hijacking, mvd]
author: "Alexander Buran"
publisher: "XAB.info"
---

# Mass Telegram Account Hijacking in Uzbekistan: How Scammers Use Fake 'Votes' and 'Contests'

![Smartphone in hand showing a Telegram phishing code request against a background of a laptop with code](https://xab.info/media/2026/10/31/massovyy-ugon-akkauntov-telegram-v-uzbekistane-feykovye-golosovaniya/massovyy-ugon-akkauntov-telegram-v-uzbekistane-feykovye-golosovaniya-1.webp)

## Key Points

- A massive wave of Telegram account hijacking via phishing links disguised as contests and votes has been recorded in Uzbekistan
- Attacks spread on behalf of already hacked contacts, increasing victims' trust
- The attack scheme includes 5 steps: from a request to vote to extorting money via the captured account
- The MIA recommends enabling two-factor authentication and never sharing the 5-digit confirmation code
- If an account is compromised, it is necessary to immediately terminate active sessions and warn contacts

A sharp wave of mass Telegram account hijacking has been recorded in Uzbekistan. According to the Ministry of Internal Affairs Cybersecurity Center and the Tashkent City Main Directorate of Internal Affairs, cybercriminals are actively spreading phishing attacks under the guise of participating in fake 'contests' and 'votes'. Law enforcement agencies officially warned about this on October 30, 2026, urging citizens to show increased vigilance online. A particular danger lies in the fact that malicious messages do not come from unknown numbers, but from already hacked accounts of close acquaintances, friends, and family members, which significantly increases the victim's trust in the received link.

### Five Steps to Losing Control of Your Account

The attack scheme described by cybersecurity specialists is built on the classic principle of social engineering and consists of five consecutive stages. At the first stage, the victim receives a 'sincere' request from an acquaintance: 'Hi, please click the link and vote for my nephew' or 'We are participating in a contest for the best mother/grandmother.' At the second stage, the link opens a fake page that completely mimics the design and interface of Telegram. The third step is a data request: under the guise of 'confirming the vote', the site asks to enter a phone number and a five-digit secret code sent by the Telegram app. The fourth stage happens instantly: as soon as the code is entered, scammers gain access to the account from another device and forcibly terminate all active sessions of the victim. At the fifth and final stage, new scam messages are sent to all contacts through the captured profile, or requests are made to loved ones to urgently transfer money to a card.

### Why Victims Don't Notice the Catch

The key element of the attack's success is the use of trust. Since the message comes from a person the recipient trusts, critical thinking is turned off. The user perceives the request as a normal everyday situation: helping a relative vote for a child in a school contest or supporting a friend in a 'best grandmother contest'. The phishing page is visually indistinguishable from the official Telegram interface, eliminating visual markers of deception. This is why law enforcement emphasizes that the source of the link does not matter—only the link itself and the fact that it requires entering a confirmation code matter.

### Three Rules of Digital Hygiene That Save an Account

The MIA Cybersecurity Center has formulated three basic protection rules. First: never click on suspicious links, even if they were sent by your closest relative. If the message concerns votes, gifts, or cash prizes, you must first call the sender by voice and clarify whether they actually sent this link. The second rule: under no circumstances give out the five-digit security code on any websites or to anyone. This code is confidential information equivalent to a password. The third and most technically significant rule is to immediately enable two-factor authentication (2FA). In the Telegram app, this is done via 'Settings' → 'Privacy and Security' → 'Two-Step Verification', where a complex password is set and an email address is linked. With 2FA enabled, even if the confirmation code is intercepted, the attacker will not be able to log into the account without the additional password.

### What to Do If Your Account Is Already Compromised

If a user has already entered the code and discovered that the account has been hijacked, every second is critical. Experts recommend immediately terminating all active sessions: in the 'Settings' → 'Devices' section, delete all unknown devices from which access is maintained. Next, set a two-step password as soon as possible or initiate a temporary freeze of the account through Telegram support. The third mandatory step is to warn all close ones and contacts via voice call or alternative communication channels that the account has been hacked so they do not become the next victims of scam messages sent on behalf of the owner. The faster these actions are taken, the fewer contacts will be involved in the attack chain.

### Official Position of Law Enforcement Agencies

The MIA Cybersecurity Center and the Tashkent Main Directorate of Internal Affairs urge all citizens of Uzbekistan to follow the rules of digital hygiene and actively warn their loved ones, especially elderly people, who most often become targets of such attacks. Law enforcement notes that the mass nature of the attack and the use of already compromised accounts to spread phishing links create a 'snowball' effect: each new victim account becomes a tool for capturing the next one. In this regard, the MIA recommends not only protecting your own profile, but also checking whether the accounts of close ones have been hacked and, if necessary, helping them regain control over their accounts.

## Fact-Check & Sources

- [Новый вид мошенничества в Telegram: схема с фейковым «голосованием» – Zamin.uz, 30.10.2026](https://zamin.uz/ru/tekhnologii/225935-novyy-vid-moshennichestva-v-telegram-skhema-s-feykovym-golosovaniem.html) - Official warning from the MIA Cybersecurity Center and Tashkent Main Directorate of Internal Affairs, published on 30.10.2026. Contains the complete attack scheme and protection recommendations.

## FAQ

### How do scammers gain access to a Telegram account?

Through a phishing page mimicking the Telegram interface that requests a phone number and a 5-digit confirmation code. After entering the code, attackers log into the account from another device and terminate all sessions of the victim.

### Why do messages come from acquaintances?

Because the accounts of these acquaintances were already hacked earlier. Scammers use their contacts to send new phishing links, relying on trust between people.

### What should I do if I already entered the code?

Immediately go to 'Settings' → 'Devices' and delete all unknown sessions. Set up two-factor authentication or freeze the account. Call your loved ones and warn them that your account has been hacked.

### How to enable two-factor authentication in Telegram?

Go to 'Settings' → 'Privacy and Security' → 'Two-Step Verification', set a complex password, and link your email address.