A Telegram account-takeover operation by npm publisher shetty123 (shettysaikumar3@gmail.com). Pairs a malicious client (common-tg-service) with the operator's server-side runtime (ams-ssk) deployed at cms.paidgirl.site. Targets Indian Telegram accounts for downstream UPI payments fraud.
Hijack Telegram accounts at scale via 2FA implantation, IMAP-based confirmation-code harvesting, and forced session eviction; harvest OTP login codes for on-demand account access.