Telegram Dating Bot Used to Recruit Young Saboteurs

How the attack worked

This case, as described in Russian authorities' allegations, centers on a Telegram dating chatbot called Daivinchik/Leo. According to the claims, agents posed as young women to strike up conversations with young Russians. What began as friendly, romantic-seeming outreach was allegedly used to build trust before shifting toward manipulation. Once a target was engaged, the conversation reportedly escalated into pressure to complete "tasks," eventually leading to coercion into committing real-world crimes.

The alleged downstream impact was severe: authorities claim targets were pushed toward attacking law enforcement officers or setting fire to transport, energy, communications, and financial infrastructure. Russian officials say 46 people aged between 12 and 22 were arrested after being recruited this way.

Why it succeeded

The scenario relied on a well-known manipulation pattern: romance and relationship-building used as a wedge for later coercion. A few factors likely contributed to its effectiveness:

• Dating and chat platforms are designed to normalize contact from strangers, lowering initial suspicion.
• Younger users, including teens and young adults, may have less experience recognizing manipulation tactics that unfold gradually over time.
• The shift from casual chat to secrecy or urgency can happen slowly, making it harder for a target to notice they've crossed into risky territory.
• Once some level of trust or personal investment exists, coercion becomes easier to apply, especially if threats or pressure are introduced later in the relationship.

What to watch for

Defenders and awareness programs should highlight these red flags:

• A stranger who rapidly builds intimacy or emotional connection online, then shifts tone toward secrecy or urgency.
• Requests to take actions offline that are framed as "proof," "a challenge," or a favor, particularly if those actions are illegal or physically risky.
• Any escalation from ordinary conversation toward coercion, threats, or demands tied to the relationship.

Building resistance

Because this activity happened on a messaging platform and chatbot rather than email, organizations should treat non-email channels as part of their awareness scope, not just traditional phishing simulations. Practical steps include:

• Extending training and reporting paths to cover Telegram, dating apps, and similar chat-based platforms.
• Specifically addressing high-risk demographics, such as interns, early-career staff, and younger employees, who may be more exposed to relationship-based manipulation.
• Reinforcing that any online relationship pushing toward secrecy, urgency, or illegal action should be paused and reported, regardless of how the relationship began.
• Encouraging a low-friction way for employees to report uncomfortable or manipulative online interactions without fear of embarrassment.

What happened in this attack?

Russian authorities allege that agents posed as young women on a popular Telegram dating chatbot to contact and entrap young Russians, then coerced them into committing crimes, including attacks on infrastructure.

What social engineering technique was used?

The scenario used romance and relationship-style outreach that gradually escalated into secrecy, urgency, and pressure to complete real-world tasks, a classic entrapment and coercion pattern.

Who was targeted?

The case reportedly involved teens and young adults, with authorities claiming 46 people aged between 12 and 22 were arrested after being recruited through the bot.

What should organizations do about this kind of risk?

Awareness programs should extend beyond email phishing to cover messaging apps and chatbots, and should teach staff, especially younger or early-career employees, to recognize escalation from casual chat to risky requests.