Attackers are impersonating Key Opinion Leader (KOL) accounts to deceive users into joining exclusive "Alpha" groups. These groups replicate fake bot verification safeguards to either steal Telegram account credentials or deploy malware, such as trojans, on users' devices.