Dating Bot Used to Recruit Teens for Sabotage

How the Alleged Recruitment Worked

According to Russian authorities, this case centers on a Telegram dating bot called Daivinchik. Operatives allegedly posed as young women online, using the bot to strike up conversations and build relationships with targets over time. Once trust was established, the FSB claims these operatives persuaded or coerced targets into carrying out real-world tasks, escalating from casual chat to instructions for sabotage and arson, including setting fire to gas stations.

This pattern reflects a classic social engineering arc: a friendly, low-stakes opening followed by gradual escalation toward a harmful ask. The channel (a dating/chat bot) and the pretext (a peer or romantic interest) were chosen specifically because they lower a target's guard.

Why This Approach Succeeded

Several factors made this kind of manipulation effective, based on the reporting:

• The pretext relied on relationship-building rather than a single urgent message, which made the eventual request feel like it came from someone the target already trusted.
• Young and early-career targets, including teenagers, may be less practiced at recognizing manipulation tactics that unfold gradually over messaging apps rather than through obvious phishing emails.
• Anonymous handlers directed actions without ever presenting a verifiable identity, which is a structural weakness in trust that only becomes visible once someone stops to question the relationship.
• Russian authorities said 46 people between the ages of 12 and 22 had been detained since last summer over the alleged recruitment campaign, suggesting the approach was applied at scale across a young target population.

What to Watch For

Key red flags identified in this case include:

• A new online contact who quickly pushes for secrecy or urgency
• A conversation that shifts from casual chat toward requests to help with illegal or risky "missions"
• Instructions coming from an anonymous handler rather than someone whose identity can be confirmed

These patterns are not limited to any one platform or region and can appear in any messaging or dating app context where a stranger tries to build rapport quickly before making an unusual ask.

Building Resistance

Organizations and families supporting younger or early-career staff should consider:

• Treating relationship-building from unknown online contacts as a potential manipulation tactic, especially when it shifts toward secrecy, coercion, or requests for action
• Encouraging immediate escalation if someone met online asks for a real-world favor, whether it is a delivery, a site visit, photos, or anything resembling vandalism or sabotage
• Extending awareness training beyond email phishing to cover social media and messaging app recruitment tactics, since younger and early-career audiences may primarily encounter manipulation through these channels rather than corporate email

What was the Daivinchik dating bot used for?

Russian authorities allege it was used by operatives posing as young women to build online relationships with targets before persuading or coercing them into carrying out sabotage.

Who was targeted in this recruitment scheme?

According to Russian authorities, 46 people between the ages of 12 and 22 were detained in connection with the alleged recruitment campaign.

What tasks were recruits allegedly asked to do?

The FSB claims recruits were directed by anonymous Telegram handlers to carry out sabotage, including setting fire to gas stations.

What red flags should people watch for in similar scams?

Warning signs include a new online contact quickly pushing secrecy or urgency, requests to escalate from casual chat to risky real-world tasks, and instructions coming from an anonymous handler rather than a verifiable identity.