Telegram ‘Partner’ Recruitment for RaaS — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 29, 2026

Severity: HIGH | View Full Scam Details

Telegram ‘Partner’ Recruitment for RaaS Scam in India 2026: Beware of Fake Job Offers on WhatsApp

A new high-risk scam in India is using Telegram channels to recruit people as ‘partners’ for ransomware attacks, promising quick money but trapping victims into cybercrime activities.

What Is the Telegram ‘Partner’ Recruitment for RaaS?

The Telegram ‘Partner’ Recruitment scam involves fraudsters posing as operators of ransomware-as-a-service (RaaS) platforms. These scammers create Telegram channels that advertise lucrative jobs for individuals to become their ‘partners’ or ‘affiliates’ in carrying out ransomware attacks. People across India, especially job seekers looking for fast income, are targeted through these channels, which often use regional languages like Hindi, Tamil, Telugu, and Bengali to reach a wider audience.

The scam is relatively new but spreading rapidly, with multiple complaints reported across states like Uttar Pradesh, Maharashtra, Tamil Nadu, and West Bengal. Scammers exploit financial pressures, particularly during festivals or economic slowdowns, to lure victims. The partners recruited may have little to no technical knowledge but are enticed by promises of INR 20,000 to 50,000 per task, encouraging participation in illegal ransomware campaigns.

Official agencies such as CERT-In and the Indian Cyber Crime Coordination Centre (I4C) have issued general advisories warning against such fraudulent job offers on messaging platforms. The Reserve Bank of India (RBI) also reminds users to be cautious about unauthorized digital financial services linked to cybercrime activities, aligning with their guidelines on safe digital payments and UPI security.

How This Scam Works — Step by Step

1. Initial Contact on WhatsApp or Telegram: The fraudster sends a WhatsApp message or Telegram invite claiming to be from a ‘recruitment partner’ of a ransomware group or service. The message often promises quick earnings with minimal work.

2. Joining a Telegram Channel: The victim is asked to join a specific Telegram channel where 'partner' work details are shared. This channel may be advertised extensively on social media or through private messages.

3. Signing an ‘Agreement’: To appear legitimate, scammers request that the individual sign a fake contract or digital agreement promising confidentiality and payment milestones, often without legal validity.

4. Getting ‘Training’ or Instructions: The victim receives documents or videos explaining how to deploy ransomware, or more commonly how to help with distribution links, phishing tactics, or email campaigns — all criminal acts.

5. Providing Personal or Financial Information: Victims are asked to share bank details, PAN numbers, or Aadhaar for ‘payment processing’. Sometimes they are persuaded to install remote access apps or share OTPs, facilitating account takeover.

6. Carrying Out Illegal Tasks: The ‘partners’ send ransomware emails or phishing links, unknowingly supporting cybercriminals. In some cases, they are made to forward ransomware payloads to contacts or use compromised systems.

7. Victim Loses Money and Becomes Involved in Crime: Payments promised are delayed or never arrive. Victims may incur losses through fake UPI transactions or SIM swap fraud if their mobile information is exploited. They also risk being named in police cases for cybercrime.

Real Warning Signs to Watch For

• Messages promising unusually high income for no prior experience or minimal effort
• Invitations coming from unknown numbers or suspicious Telegram channels
• Requests to join secret Telegram groups without official job documentation
• Being asked to share sensitive details such as PAN, Aadhaar numbers, or bank accounts early on
• Instructions to install unknown apps or remote access software
• Urgency to sign contracts or agree to terms digitally without proper paperwork
• Offers linked directly to ransomware or hacking-related activities

What Happens to Victims

Victims of the Telegram ‘Partner’ recruitment scam often face severe financial losses. Many report unauthorized UPI transactions or fund deductions after sharing bank details. Since their phone numbers are involved in SIM swap schemes, attackers gain deeper access to personal data and payment apps linked via mobile authentication. Some victims find their Aadhaar numbers misused to file fraudulent KYC (Know Your Customer) details or open new accounts for laundering ransom payments.

Emotionally, these victims experience high stress and fear of legal consequences because unknowingly participating in ransomware campaigns puts them at risk of police investigation under IT Act provisions. The trauma of financial loss coupled with defamation concerns severely affects mental health in families, especially those relying on honest daily wages.

What RBI and CERT-In Say

While no specific advisory targets this Telegram RaaS recruitment scam yet, RBI continues to caution users against unsolicited financial job offers and reminds them to verify credentials before sharing banking information. The RBI’s guidelines on digital payments urge the public to treat all transactional OTPs and UPI PINs as highly confidential.

CERT-In regularly updates its advisories on phishing and ransomware attacks, urging citizens not to click suspicious links or download software from untrusted sources. The Indian Cyber Crime Coordination Centre (I4C) runs the 1930 cybercrime helpline where affected individuals can report violations and get assistance.

How to Protect Yourself

1. Avoid Job Offers from Unknown Contacts on WhatsApp or Telegram — always verify through official company channels.
2. Never Share Aadhaar, PAN, Bank Details, OTP, or UPI PINs on Messaging Apps. Legitimate recruiters do not ask for these upfront.
3. Do Not Join Unofficial Telegram Channels Promising Easy Money or Cybercrime Affiliations.
4. Be Wary of Any ‘Contract’ That Pushes You to Carry Out Cyber Activities Like sending ransomware or phishing links.
5. Use RBI-Approved UPI Apps and Enable Transaction Alerts to monitor unauthorized deductions.
6. Install Anti-virus and Anti-malware Apps Recommended by CERT-In and keep your devices updated.
7. Report Suspicious Messages to BharatSecure.app and Block Unknown Contacts Immediately.

What to Do If You’ve Been Targeted

• Immediately Block the Fraudulent Contact and exit suspicious Telegram channels.
• Freeze Your Bank Account and UPI Transactions by contacting your bank’s customer service.
• Change All Relevant Passwords and Enable Two-Factor Authentication on financial and social accounts.
• Report the Incident to Your Local Police Cyber Cell and File a Complaint on cybercrime.gov.in.
• Call the 1930 Cybercrime Helpline for Guidance and Support.
• Inform UIDAI if Aadhaar Details Are Compromised to place alerts on biometric authentication.

Frequently Asked Questions

Q: Can I legally lose money just by joining these Telegram ‘partner’ channels?
Joining such channels may not directly cause financial loss, but scammers often require personal info or app installations that lead to unauthorized bank transactions or SIM swaps, resulting in monetary loss.

Q: How can I differentiate legit job offers from fake RaaS recruitment on messaging apps?
Legitimate jobs never ask for sensitive financial details upfront, do not require you to engage in hacking activities, and usually recruit through verified portals or company websites.

Q: What immediate steps should I take if I shared my UPI or Aadhaar information with these scammers?
Contact your bank to block transactions, report on cybercrime.gov.in, change all related passwords, and notify UIDAI for Aadhaar security measures. Use the 1930 helpline for further support.

If you receive any suspicious job offers or messages about ‘partner’ recruitment on Telegram or WhatsApp, verify them first at BharatSecure.app and report fraud attempts at the 1930 helpline.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.