Loading story…
Researchers reported multiple malware families abusing Telegram as a command-and-control and exfiltration channel, highlighting how attackers are repurposing the messaging platform’s bot infrastructure for low-cost, resilient operations. Check Point detailed ToxicEye, a multi-function remote access trojan delivered through phishing emails with malicious executables or documents, and said it was observed in more than 130 attacks over a three-month period. Once installed, ToxicEye can steal data, manipulate files, terminate processes, log keystrokes, capture clipboard contents, hijack microphones and cameras, and encrypt files in a ransomware-like manner.
The reporting also linked ToxicEye to a broader pattern that includes Masad Stealer, another malware family using Telegram to move stolen information and receive operator commands. By relying on a legitimate cloud service, attackers can blend malicious traffic with normal user activity, manage infected hosts anonymously through Telegram bots, and even administer campaigns from mobile devices. The cases underscore a continuing shift toward abuse of trusted consumer platforms to simplify malware deployment, remote control, and data theft.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
A blog post published an Android proof-of-concept app, HackContacts2, that reads a device's contacts and exfiltrates them to an attacker-controlled Telegram bot via the Telegram Bot API. The post included implementation details such as required permissions, use of ContactsContract and OkHttp, and noted testing in an emulator, on a real device, and in ANY.RUN where Telegram communication was observed.
A blog post published an Android proof-of-concept that collects device and build information and exfiltrates it to an attacker-controlled Telegram chat via the Telegram Bot API. The sample used OkHttp, stored the bot token and chat ID in local asset files, required only the INTERNET permission, and was reportedly tested on both a virtual device and a real Android 14 OPPO device.
SANS ISC analyzed an Agent Tesla sample delivered in a .daa archive that used the Telegram Bot API for command-and-control and data exfiltration instead of email servers. The analysis identified bot account "Bigdealzbot," recipient chat ID 1599705393, and observed successful uploads of keylogging logs and hourly screenshots.
The Check Point article cites Masad as an earlier info-stealer that used Telegram as command-and-control or exfiltration infrastructure. It places Masad as an early example of malware abusing Telegram for attacker communications.
Check Point publicly documented ToxicEye as a Telegram-based RAT and disclosed its capabilities, delivery methods, detection names, and an indicator of compromise at C:\Users\ToxicEye\rat.exe. The report also highlighted suspicious Telegram traffic from enterprise PCs as a possible sign of compromise.
Check Point Research reported observing more than 130 attacks using the ToxicEye remote access trojan over a three-month period. The malware was delivered via phishing emails and used Telegram bots for command-and-control.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cocomelonc.github.io
Open sourcecocomelonc.github.io
Open sourceisc.sans.edu
Open sourceblog.checkpoint.com
Open sourceblogs.juniper.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that Telegram has become a major channel for **infostealer** operators to exfiltrate stolen data and distribute victim logs, exposing a large volume of corporate credentials and access data. BitSight said analysis of roughly 1,800 Telegram bots collected from October 2024 onward uncovered about **5 million logs**, **2.8 million credentials**, more than **400,000 unique domains**, and over **10,000 unique IP addresses**, with credentials linked to nearly **60,000 organizations**. The activity reflects a broader Russian-speaking infostealer ecosystem in which harvested logs are packaged, shared, and monetized for follow-on intrusion activity. The most prominent malware families observed were **SnakeKeylogger** and **AgentTesla**, with SnakeKeylogger rising sharply and **VipKeylogger** appearing as a SnakeKeylogger variant, while AgentTesla/OriginLogger activity declined after operators reportedly lost access to servers and backups. Infections were globally distributed, led by the **United States, Turkey, and Russia**, followed by **India and Germany**. The findings underscore that stolen credentials remain a key initial-access vector, prompting recommendations to block `api.telegram.org` where not required, enforce **MFA**, and monitor for leaked credentials tied to enterprise accounts.
Aug 15, 2026
Researchers reported multiple Android remote access trojans using **Telegram’s Bot API** for command-and-control and data exfiltration, with **TeleRAT**, **IRRAT**, and the later **HeroRat** targeting users primarily in Iran. The malware hid its activity within legitimate Telegram communications while giving operators broad surveillance and device-control capabilities, including theft of **SMS**, contacts, account data, files, photos, location, and clipboard contents, as well as support for calls, texting, audio recording, picture capture, screen recording, and device settings manipulation. Palo Alto Networks identified **2,293 victims**, about **82%** tied to Iranian phone numbers, and said the activity likely involved several actors rather than a single group. The malware was distributed through **third-party Android app stores**, Telegram channels, social media, and messaging apps using lures such as fake VPN tools, profile-viewer apps, Telegram Finder, free bitcoins, free internet, and social-media follower offers. ESET said **HeroRat** emerged as a distinct family after source code leaked on Telegram channels, leading to many variants and a commercialized version marketed under that name; once installed, it displayed a fake uninstall message while remaining active. Researchers also found repeated operational security failures around the ecosystem, including exposed bot histories, hardcoded API keys, accessible webhooks, and public advertising of malware code and bot-control libraries, while noting the malware was **not observed on Google Play**.
Aug 14, 2026
K7 Security Labs identified **ResokerRAT**, a Windows remote access trojan that uses Telegram’s Bot API as its command-and-control channel instead of dedicated attacker infrastructure. The malware, delivered as `Resoker.exe`, polls Telegram endpoints such as `getUpdates` with hardcoded bot credentials and chat IDs, allowing commands and stolen data to move over trusted HTTPS traffic to `api.telegram.org`, which can make network-based detection more difficult. Researchers said the malware supports **screen capture, keylogging, file download, privilege escalation, and persistence**, while also attempting to evade analysis and disrupt defenders. ResokerRAT creates a mutex, checks for debuggers, relaunches with administrator rights, blocks tools including Task Manager and Process Hacker, weakens UAC-related settings, and adds itself to the Windows Run registry key for startup execution. Defenders were urged to monitor suspicious outbound Telegram API traffic, Run key persistence, restricted PowerShell activity, and user reports that security or system tools suddenly cannot be opened.
Jun 29, 2026