Hackers Used Open Tracking to Stalk an Exiled Activist

The activist opened the link and did nothing else. No password, no login code, nothing typed into the page. A short while later a second message arrived from the same account, reporting back the exact time the link had been opened, the device used, and the network it came from.

That second message was the attack. Everything before it was reconnaissance, running on the same plumbing that tells a marketing team you read their newsletter.

Key Takeaways

• RESIDENT.NGO published two reports on July 23, 2026 on a Telegram phishing operation against an exiled Belarusian activist in Lithuania.
• Researchers recovered 64 distinct phone numbers embedded in individualized phishing links across seven domains: 55 Russian, 7 Belarusian and 2 Kazakhstani.
• The infrastructure has run since at least October 2024, roughly 21 months of observed activity across Russia, Belarus and Kazakhstan.
• Operators logged when the target opened the link, then sent a follow up message quoting that timestamp, device and network provider back at them to manufacture credibility.
• The pages inspected browser and platform signals before rendering, sending Firefox visitors to the real telegram.org/faq and Windows visitors to a forged Cloudflare error page, so scanners saw nothing worth flagging.

What Did the Reports Actually Document?

A Telegram account takeover operation that harvested login codes rather than planting malware, aimed at people in Russia, Belarus and Kazakhstan, with at least one exiled Belarusian activist in Lithuania among the targets. The sending account was created in June 2025 and registered to a Kazakhstani phone number. The lure arrived inside a Telegram Secret Chat, end to end encrypted and awkward to preserve as evidence.

The pretext was mundane: complaints had been filed, restrictions were being applied, follow this link to confirm ownership. The Russian text was tuned to slip past filters, with roughly one hundred Cyrillic characters swapped for identical Latin and Greek homoglyphs. To a human it looked normal. To a keyword filter it was gibberish.

This target recognized it, typed nothing, and handed the whole thing to researchers. As The Record reported, RESIDENT.NGO could not establish how many people were reached or whether any account was taken over.

What Do 64 Phone Numbers Inside a Link Tell You?

They tell you the operators were running a mailing list, not a spray campaign. The companion report, "A Telegram of Trouble," reconstructed the link format across seven domains including tgcheckprotect and tg-confirm. Each URL looked like this:

https://telegram.org@<phishing-domain>/?<Base64 of the phone number>

Everything before the @ is discarded by the browser as user information, so the visible "telegram.org" is decoration. The query value decodes to the recipient's own phone number, which the server prints back onto the fake page. The framework also set a userID cookie holding that encoded number and a country_code cookie derived from the visitor's IP.

Strip away the intent and you are looking at a merge field, a technique marketing platforms have shipped since the early 2000s.

Why Is Knowing That You Opened It Worth Anything?

Because an open confirms three things before a single credential changes hands: the account is live, the person behind it is reachable, and they were awake and online at a specific minute. That is targeting intelligence, and it costs the operator nothing to collect.

Repeat it and it compounds. Ten sends produce an activity window: when they check messages, when they sleep, which days they travel. Academic work anticipated this precisely. Xu, Hao, Sari and Wang's IEEE INFOCOM 2018 paper "Privacy Risk Assessment on Email Tracking" warned that read metadata alone lets an observer infer a recipient's real world identity, reading environment, current whereabouts, and work and sleep schedule — enough to mount a sustained surveillance attack by doing nothing but sending mail.

Eight years later, RESIDENT.NGO documented that threat model running against a human rights target. The paper described the capability. The reports describe the deployment.

The Follow Up Message Is the Real Weapon

After the activist opened the link, the operators sent a second message stating the timestamp of the visit, the device, and the connection location and ASN — then pressed them to return and finish. RESIDENT.NGO's "Check and Protect" analysis lays out the sequence.

Consider the effect on judgment. Everything quoted back is true. You were on that phone, on that provider, at that minute. None of it could have been guessed, so it reads as privileged access — exactly how a real platform security team would sound. The telemetry did not need to be secret. It only needed to be accurate.

None of it came from anywhere exotic. Device and platform came from client hints the browser volunteers on request — the infrastructure advertised Accept-CH for Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform and Sec-CH-UA-Model. Network came from the source IP, timing from the request log. Every web server records all three by default.

How Did the Pages Stay Invisible to Scanners?

By answering different visitors differently, a technique the ad industry calls cloaking. The server weighed the browser's User-Agent, the platform client hint, and whether the URL token was a valid encoded number, then branched:

• Firefox visitors were redirected to the genuine telegram.org/faq.
• Windows visitors received a forged Cloudflare error page.
• Linux, Android or Safari clients arriving with a valid token were shown the phishing interface, a copy of Telegram Web.
• Malformed tokens triggered a holding loop that quietly gathered more fingerprinting data.

This is why "I checked the link and it went to Telegram" is worthless as a safety test. A URL scanner, a sandbox, a colleague on a Windows laptop and the intended target can request the same address and get four different answers. RESIDENT.NGO's conclusion for defenders: detection has to lean on URL structure, delivery pattern and hosting context, not whatever one visit happens to return.

What This Means for Your Inbox

Line up the four techniques: every one is standard email marketing equipment. A unique identifier per recipient in a link is a merge tag. A callback that fires on open is a 1x1 tracking pixel. Device, platform and network captured from the request is what an email service provider labels device and location analytics. Serving bots something different from humans is what deliverability vendors do to keep spam filters calm.

Volume is what makes it unremarkable. That INFOCOM study sampled 44,449 emails from 928 domains and found tracking beacons in up to 24.7% of them: 17.3% carrying invisible pixel images, 13.3% carrying links with the recipient's address or a hash of it embedded. Meanwhile 52.1% of 291 survey participants had no idea opening a message could be observed. Click tracking runs the same play, rewriting destinations so every tap routes through a logging server first, as we broke down in how email link wrapping turns every click into a data point.

Here is the uncomfortable part: an intelligence service does not need to build any of this. The commercial sector spent two decades industrializing per recipient tracking and making it cheap enough to run from a rented VPS. An operator targeting an exiled activist is buying a solved problem. The path from marketing analytics to account takeover is short — the hijacking of Ksenia Sobchak's Telegram through her email account followed the same arc.

What Should You Do If Your Threat Model Is Raised?

Treat the open itself as the leak, not just the credential. Civil society is a standing target: Access Now and the Citizen Lab documented COLDRIVER and COLDWASTREL campaigns against Russian and Belarusian nonprofits, independent media and international NGOs using the same personalized approach.

• Turn off remote image loading. Images that load automatically are the open beacon. Blocking them removes the confirmation signal entirely.
• Run a tracking blocker. Pixels and rewritten links can be stripped before they fire; how to spot tracking pixels hiding in your Gmail covers finding them by hand.
• Never type a login code into a page you reached from a link. Telegram, Signal and Google will not ask. A five digit code relayed to an operator inside its validity window is a finished takeover.
• Verify platform notices inside the platform. Open the app yourself and check the official service account. A genuine restriction shows up there.
• Enable a cloud password. Telegram's two step verification means a stolen login code alone is not enough.
• Use per contact aliases. If one address or number is burned, it does not resolve to your whole life.
• Assume opens are logged. When you must open something suspect, use a device and network you are willing to disclose.

The activist in Lithuania did everything right and still gave up a timestamp, a device profile and a network. That is the floor, not the failure. The failure would have been typing the code.

Sources: RESIDENT.NGO, "Check and Protect: Analysis of Telegram Phishing Operation Targeting Exiled Activist" (July 23, 2026), RESIDENT.NGO, "A Telegram of Trouble: Tracking a Regional OTP Phishing Infrastructure Targeting Users in Russia, Belarus and Kazakhstan for 2 Years" (July 23, 2026), The Record, "Telegram phishing campaign targeted exiled Belarusian activist, Russians and Kazakhstanis", Xu, Hao, Sari and Wang, "Privacy Risk Assessment on Email Tracking," IEEE INFOCOM 2018, and Access Now and the Citizen Lab on phishing campaigns against civil society and NGOs.