A cybersecurity researcher uncovered a sophisticated Telegram scam bot posing as a woman named Maria P during what appeared to be a romance scam attempt. The account lacked a username, featured a profile photo of a woman by the sea, and initiated contact by asking for IT learning resources after spotting the target in an IT-related group.
Key evidence emerged from response timing. Messages received consistent 4-5 minute delays across day and night sessions, regardless of content complexity. This fixed pause, implemented via a constant DELAY value in the code, pointed directly to automation rather than human typing.
Further proof came when the researcher sent a system override injection and immediately deleted it. The bot replied to the nonexistent message five minutes later, confirming that incoming text was queued without checking message existence at response time. The bot also accumulated multiple messages and replied to the batch in one go.
The bot refused tasks inconsistent with its legend using a repetitive template: "I am not a cookbook," "I am not a text editor," and similar phrases. This behavior matched a system prompt instructing the model to deflect utility requests while maintaining the persona of a recently divorced salon owner from Yaroslavl.
Media files and contradictory messages broke the pattern. Voice messages and GIFs were marked read but received no reply or triggered long delays, indicating handover to a human operator via a manual flag. The operator eventually deleted the entire chat for both parties after the testing became obvious.
The researcher reconstructed the bot using the Telethon library. The code subscribed to private messages, stored pending text, applied a fixed sleep interval, and called an LLM function with a carefully engineered prompt that included anti-jailbreak instructions. A simple random delay would have hidden the automation, but the implementation used a static value.
The case demonstrates how prompt injection testing, nonexistent location checks, and media handling can expose AI-assisted social engineering operations that combine scripted responses with occasional human oversight.
