Loading story…
Threat intelligence reporting based on CYFIRMA research says Telegram is increasingly functioning as a high-speed replacement for traditional Tor-based cybercrime forums, enabling threat actors to trade stolen data and coordinate operations with minimal friction. The reporting highlights that, unlike darknet marketplaces that can be dismantled by law enforcement takedowns (e.g., Hydra Market, RaidForums), Telegram channels can be rapidly recreated and audiences redirected via forwarding links, reducing operational downtime for criminal communities.
The research describes Telegram channels and bots being used to broker initial access into enterprises—advertising access to corporate VPNs, RDP, and cloud environments (including Azure and AWS)—often supported by “proof” such as screenshots of portals or dashboards. It also notes active commerce in stealer logs, Malware-as-a-Service offerings (e.g., stealers/loaders sold via subscriptions), and broader ecosystem uses including ransomware victim-shaming/leak promotion, affiliate coordination and recruitment, and hacktivist coordination, with automation (bots) accelerating search, fulfillment, and payment workflows.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-02-26, CYFIRMA published an analysis describing Telegram as a major operational platform for cybercriminals, increasingly taking over functions once centered on Tor-based forums and marketplaces. The report highlighted sales of corporate initial access, malware-as-a-service, stealer-log distribution, ransomware leak activity, and hacktivist coordination on the platform.
Telegram transparency reporting for 2024 showed increased sharing of user data with law enforcement, including about 900 U.S. requests affecting more than 2,200 users and 142 UK cases affecting 293 users. Despite this, reporting said cybercriminal use of the platform continued to expand.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehackread.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple malware families abusing **Telegram** as a command-and-control and exfiltration channel, highlighting how attackers are repurposing the messaging platform’s bot infrastructure for low-cost, resilient operations. Check Point detailed **ToxicEye**, a multi-function remote access trojan delivered through phishing emails with malicious executables or documents, and said it was observed in more than 130 attacks over a three-month period. Once installed, ToxicEye can steal data, manipulate files, terminate processes, log keystrokes, capture clipboard contents, hijack microphones and cameras, and encrypt files in a ransomware-like manner. The reporting also linked ToxicEye to a broader pattern that includes **Masad Stealer**, another malware family using Telegram to move stolen information and receive operator commands. By relying on a legitimate cloud service, attackers can blend malicious traffic with normal user activity, manage infected hosts anonymously through Telegram bots, and even administer campaigns from mobile devices. The cases underscore a continuing shift toward abuse of trusted consumer platforms to simplify malware deployment, remote control, and data theft.
Aug 15, 2026
Researchers reported that Telegram has become a major channel for **infostealer** operators to exfiltrate stolen data and distribute victim logs, exposing a large volume of corporate credentials and access data. BitSight said analysis of roughly 1,800 Telegram bots collected from October 2024 onward uncovered about **5 million logs**, **2.8 million credentials**, more than **400,000 unique domains**, and over **10,000 unique IP addresses**, with credentials linked to nearly **60,000 organizations**. The activity reflects a broader Russian-speaking infostealer ecosystem in which harvested logs are packaged, shared, and monetized for follow-on intrusion activity. The most prominent malware families observed were **SnakeKeylogger** and **AgentTesla**, with SnakeKeylogger rising sharply and **VipKeylogger** appearing as a SnakeKeylogger variant, while AgentTesla/OriginLogger activity declined after operators reportedly lost access to servers and backups. Infections were globally distributed, led by the **United States, Turkey, and Russia**, followed by **India and Germany**. The findings underscore that stolen credentials remain a key initial-access vector, prompting recommendations to block `api.telegram.org` where not required, enforce **MFA**, and monitor for leaked credentials tied to enterprise accounts.
Aug 15, 2026
Multiple reports highlight a surge in **social-engineering-led initial access**, with attackers increasingly relying on trusted-looking delivery mechanisms rather than novel exploits. Microsoft-described activity impersonates *Zoom*, *Microsoft Teams*, and *Adobe Reader* updates and uses **stolen Extended Validation (EV) code-signing certificates** (including one issued to **TrustConnect Software PTY LTD**) to make malicious executables appear legitimate; lures include fake meeting invites and deceptive download sites, and payloads commonly install **RMM tooling** such as *ScreenConnect* and *MeshAgent* for persistent access, followed by additional tooling via encoded PowerShell. Separately, Moonlock reported a **ClickFix**-style operation targeting crypto/Web3 professionals via **fake venture capital personas on LinkedIn**, redirecting victims through Calendly to spoofed video-conferencing pages to induce execution of attacker-supplied commands, with infrastructure tied to multiple fake firms (e.g., *SolidBit Capital*, *MegaBit*, *Lumax Capital*) and domains attributed to a single registrant. In parallel, NCC Group’s Fox-IT assessed that **messaging platforms** (e.g., WhatsApp, Telegram, Discord, Signal, LinkedIn messaging) are increasingly used to deliver phishing links, malicious attachments, QR codes, and fake invitations while bypassing traditional email controls, and that Telegram in particular is also used to host phishing infrastructure, malware repositories, and bot-enabled fraud services. One referenced item is materially different from the above social-engineering theme: reporting on suspected **DPRK-linked intrusions** into cryptocurrency organizations describes web-app exploitation (including `CVE-2025-55182` in *React2Shell*) and the use of pre-obtained **AWS access tokens** to steal source code, private keys, and cloud secrets—an intrusion set focused on direct compromise and theft rather than the phishing/update-impersonation and messaging-platform delivery techniques described elsewhere.
Jun 29, 2026