Loading story…
Researchers uncovered a Pastebin-hosted PowerShell script masquerading as "Windows Telemetry Update" that steals Telegram session data from Windows systems and exfiltrates it through the Telegram Bot API. The malware targets Telegram Desktop tdata files under %APPDATA%, gathers host metadata, terminates Telegram to release file locks, compresses the session material into diag.zip, uploads it to an operator-controlled bot, and then deletes the archive from disk. Analysis identified two versions of the script: an initial broken build that failed to upload stolen archives and a corrected v2 that fixed multipart upload logic, added fallback error handling, and sent a beacon even when Telegram was not installed.
Investigators also tied the same bot infrastructure to a separate browser-based tool designed to capture Telegram Web localStorage authorization data, indicating the operator was developing capabilities to hijack both desktop and web sessions without needing passwords or SMS codes after authentication. Hardcoded bot credentials exposed the attacker’s Telegram bot setup and message history, while a local HTTP collector at 192.168.137.131:5000, cleartext credentials, and the lack of obfuscation or persistence suggested the tooling was still in active testing and validation rather than broad operational deployment.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Flare publicly reported that the Pastebin-hosted PowerShell malware and related web-session capture tool were capable of stealing Telegram session material that could enable session replay without account credentials. The company assessed the activity as tooling under active testing rather than a broadly deployed campaign, citing cleartext credentials, lack of obfuscation or persistence, and private LAN infrastructure.
Analysis of hardcoded bot credentials and message history exposed the operator's Telegram bot infrastructure and revealed a separate browser-based tool that captured Telegram Web session material from localStorage. The web-focused component used the same bot channel and referenced a local HTTP collector at 192.168.137.131:5000.
A second version of the same PowerShell script was later posted under the same Pastebin account, fixing multipart upload logic so stolen Telegram Desktop archives could be sent through the Telegram Bot API. The updated version also added fallback error handling and a beacon even when Telegram was not installed, indicating active validation and development.
Researchers identified an initial Pastebin-hosted PowerShell script disguised as a "Windows Telemetry Update" that targeted Telegram Desktop session data but contained broken upload logic, preventing successful exfiltration. The script still showed intent to collect host metadata and archive Telegram session files from local %APPDATA% paths.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The source code for **Titan Stealer**, a Windows information-stealing malware family sold through a Russian-language Telegram channel, was publicly exposed on GitHub, where a repository advertised the **full server, client, and admin panel**. The leaked project was described as written in **C#/.NET** with a **PHP** administration panel and promoted capabilities to harvest data from more than **70 browsers** and **70 cryptocurrency wallets**, alongside file-grabber functions and server-side decryption. Security research shows Titan Stealer uses a **32-bit GCC-compiled loader** to decrypt an embedded **Golang** payload and inject it into `AppLaunch.exe` via process hollowing. Once active, it steals browser credentials, cryptocurrency wallet data, **Telegram Desktop** artifacts, FTP client details, screenshots, system information, and selected files, then exfiltrates the data to command-and-control infrastructure as a **base64-encoded archive**. Researchers said the operators actively maintained the malware, marketed updates and bug fixes, and used a dedicated panel to review victim logins and stolen data.
Aug 15, 2026
Researchers detailed **Bandit Stealer**, a Go-based information stealer for Windows that collects browser credentials, cookies, history, credit card data, cryptocurrency wallet contents, Telegram sessions, FTP and email client logins, keystrokes, clipboard data, and host profiling information. The malware attempts privilege escalation with `runas.exe`, establishes persistence through the Windows **Run** registry key, and stores stolen data in `%appdata%\local` subfolders named with the victim’s country code and IP address before archiving and exfiltrating the loot through the **Telegram Bot API**. Bandit Stealer also uses extensive anti-analysis and sandbox-evasion checks to avoid detection, inspecting virtualization and security processes, debugger presence, blacklisted IP addresses, MAC addresses, hardware IDs, usernames, and computer names, and terminating when it detects likely research environments. Researchers said the malware has been delivered through self-extracting archive droppers disguised as benign documents or installers, including decoy Word, OpenVPN-related, and fake Heartsender files, while embedded Linux paths and commands suggest the codebase may still be evolving or could expand beyond Windows.
Aug 15, 2026
Phishing emails and malicious websites were used to trick users into launching **PowerShell**-driven malware chains that installed infostealers and stole credentials, clipboard data, and host information. In one case, an EDR alert on a finance user’s device showed `msedge.exe` spawning `powershell.exe`, followed by `curl.exe`, a downloaded DLL, and `rundll32.exe`; the decoded Base64 command used an `IEX` and `Net.WebClient.DownloadString` pattern to retrieve remote code after the user clicked an “Outstanding Invoice — Action Required” lure. The payload was identified as an **AgentTesla** variant, and responders isolated the host, revoked session tokens, reset credentials, and found two additional recipients of the same phishing email, though only one clicked and SmartScreen blocked the download. A related intrusion used a phishing site that instructed victims to open PowerShell as administrator and paste an encoded command copied to the clipboard, leading to the download of a ZIP archive and execution of `updater.exe`, a packed PyInstaller-based **DXI Infostealer** sample. The malware used a **UAC bypass** via the `ms-settings` registry hijack and `computerdefaults.exe`, added Microsoft Defender exclusions, disabled protections, collected system, network, antivirus, clipboard, screenshot, and browser-related data, and packaged the results with `rar.exe` before exfiltrating them through the **Telegram API** as command-and-control. The activity showed a consistent pattern of social engineering, PowerShell abuse, defense evasion, staged payload delivery, and HTTPS or Telegram-based data theft.
Jun 29, 2026