Researcher flags 'AEGIS VPN' phishing site vpnaegis2.site harvesting card details via Telegram
@Malwarehunterr reported on 31 October 2026 that “AEGIS VPN” at vpnaegis2.site collects phone numbers, card details with CVC and verification answers and forwards them to Telegram. The report comes from one X post.
- First reported
- Reports
- 1
Source: x.com · published
What happened
A security researcher posting as @Malwarehunterr on X reported on 31 October 2026 that a site called “AEGIS VPN” at vpnaegis2.site is a phishing site that harvests phone numbers, payment card details including the CVC, and verification answers, and sends them out through Telegram. The post says Telegram API responses confirmed successful delivery of messages to three recipients, and lists vpnaegis2.site as an indicator of compromise. The claims come from the researcher's post and have not been independently verified.
How the scam works
The screenshot attached to the post shows what looks like an ordinary VPN storefront with a red-and-black design and Russian-language text under the AEGIS VPN logo. The headline promises privacy “without compromise”, and the page lists plans priced in roubles: 150 for a month, 750 for a year and 1,300 for two years, with a large “Pay” button. Features listed include support for five devices, more than 40 countries, WireGuard and protection from DNS leaks. Nothing on the page shows who runs the service.
According to the researcher, the checkout does not work like a payment page. Instead of passing details to a payment provider, it collects phone numbers, full card details and the answers to verification prompts and forwards them to Telegram, where the operators receive them in real time. With the card number, expiry date and CVC, plus the one-time code or verification answers, the operators can make payments before the victim notices.
Cheap VPN and privacy-tool storefronts are a common bait for card theft because users expect to enter payment details and may be less careful about the vendor. A real VPN provider uses a recognised payment processor and does not ask for extra verification answers on its own page.
Source
@Malwarehunterr on X, post of 31 October 2026 (screenshot and indicator). Not independently verified by scammers.com.
Red flags
- A VPN storefront with no named company, address or reviews you can verify, such as vpnaegis2.site.
- Very low prices and a prominent “Pay” button on a page you reached through an ad or message.
- A payment form that asks for your phone number, full card details including CVC and verification answers.
- Requests for one-time codes or “verification” answers during checkout.
- A domain with a numbered or unusual name that mimics a service brand.
If you were targeted
- 1Do not enter card details on vpnaegis2.site.
- 2If you did, call your bank at once, cancel the card, and dispute any charges.
- 3Do not share the one-time codes sent to your phone, and watch for follow-up calls or messages asking for more.
- 4Choose VPNs from well-known providers, with independent reviews and standard payment processors.
- 5Report phishing sites to your bank, and to the relevant national cyber-crime reporting service.