When conducting an OSINT investigation into Telegram-based gambling platforms, one usually expects to look into shady payment gateways, non-transparent privacy policies, or hidden ownership structures. You rarely expect to encounter a vector aimed directly at hijacking the user's local system terminal.
During a recent rapid infrastructure analysis of the WinGram ecosystem conducted by the bmulclan and RipReport teams, a malicious mechanism was discovered embedded within their web infrastructure.
Target Spotlight: The WinGram Ecosystem
The entry point for this investigation was the Telegram bot @wingram (along with its associated bot @wingramcom_bot) and the web domain wgmirvexa.com.
The project brands itself as an integrated Telegram gaming platform where users are prompted to authenticate via a Telegram Web App, connect their cryptocurrency wallets using TON Connect, and deposit funds to play.
The initial goal of the assessment was infrastructure mapping and verifying the platform for signs of asset draining or fraudulent operations.
Infrastructure Mapping & Static Analysis
An inspection of the frontend and core assets revealed that the website is built using the Next.js framework, while gaming media assets are loaded from an external domain: ://corewinapp.com.
- Service Worker (sw.js) Analysis
Fragments of the site's sw.js file (which utilizes the Serwist library) were analyzed. This file handles standard PWA capabilities like caching, background synchronization, and IndexedDB operations.
• Findings: Static analysis of the available code snippet showed no explicit signs of credential harvesting, unauthorized file transfers to third-party servers, or hidden remote command execution routes within the background sync processes.
- Network Anomalies
The infrastructure mapping process flagged the IP address 190.115.16.140, tied to the domain gram-app-cloud.com. The server sits behind an anti-DDoS proxy configuration, masking the true origin server location.
The Core Trigger: Intercepting a ClickFix Attack
The most critical threat to user security was identified during dynamic runtime analysis of the main domain, wgmirvexa.com. The browser extension uBlock Origin triggered a malicious activity alert:
> "Beware, uBlock Origin blocked a potential ClickFix attack"
Understanding the ClickFix Vector
ClickFix (frequently deployed as part of broader malicious social engineering campaigns like ClearFake) is a browser-based technique designed to trick users into executing local malware.
- The Deception: The website displays a simulated system error or a deceptive notification (e.g., "To view this content, update your browser" or "Copy the verification code to fix the app").
- Clipboard Manipulation: When the user clicks an interface element, the website silently overwrites the system clipboard buffer with a malicious payload string.
- Execution Trap: The on-screen instructions guide the user to manually open their computer's terminal (PowerShell, Command Prompt, or macOS/Linux Terminal), paste the copied text using Ctrl + V, and press Enter.
The moment the user executes the command, a hidden string (typically an obfuscated PowerShell web-cradle) runs locally to download and deploy infostealers, backdoors, or crypto-drainers directly onto the endpoint.
In the case of wgmirvexa.com, the team caught a definitive attempt to manipulate the clipboard buffer to stage this scenario. While the final payload command string was successfully intercepted by the blocker, the existence of such code serves as an absolute indicator of a compromised and dangerous resource.
Mitigation & Current Status
Following the verification of these vulnerabilities, immediate defensive actions were taken:
Abuse Reporting: The RipReport team formally documented the threat and submitted reports to restrict and flag the malicious assets within the Telegram platform.
Top comments (0)