The false domains identified by [BforeAI](https://bfore.ai/report/malicious-telegram-apk-campaign-advisory/) featured a QR code that redirects to a page containing reminders [Telegram](https://cyberdefence24.pl/cybersecurity/Russian-propaganda-na-x-i-telegram-second-communication-nask) – application logo and graphic motifs. On the page you can download the APK file (app installer on [Android](https://cyberdefence24.pl/cybersecurity/Chinese-spyware-hidden-in-apps-on-android) and the user is convinced to download the authoritative application.