Loading story…
Researchers reported that Telegram has become a major channel for infostealer operators to exfiltrate stolen data and distribute victim logs, exposing a large volume of corporate credentials and access data. BitSight said analysis of roughly 1,800 Telegram bots collected from October 2024 onward uncovered about 5 million logs, 2.8 million credentials, more than 400,000 unique domains, and over 10,000 unique IP addresses, with credentials linked to nearly 60,000 organizations. The activity reflects a broader Russian-speaking infostealer ecosystem in which harvested logs are packaged, shared, and monetized for follow-on intrusion activity.
The most prominent malware families observed were SnakeKeylogger and AgentTesla, with SnakeKeylogger rising sharply and VipKeylogger appearing as a SnakeKeylogger variant, while AgentTesla/OriginLogger activity declined after operators reportedly lost access to servers and backups. Infections were globally distributed, led by the United States, Turkey, and Russia, followed by India and Germany. The findings underscore that stolen credentials remain a key initial-access vector, prompting recommendations to block api.telegram.org where not required, enforce MFA, and monitor for leaked credentials tied to enterprise accounts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Bitsight began collecting data in October 2024 directly from threat actors' Telegram bots via the Telegram Bot API for its analysis of infostealer log exfiltration.
Bitsight reported that while the collected log timestamps began in 2020, the majority of the logs in its dataset were dated from 2022 onward.
The Bitsight dataset contained Telegram-exfiltrated infostealer logs with timestamps starting in 2020, though most of the observed logs were from 2022 onward.
The actors behind OriginLogger stated on their Telegram sales channel that they had lost access to their server and backups and decided to retire the service, which Bitsight linked to AgentTesla's decline.
Bitsight observed a sharp decline in AgentTesla/OriginLogger activity and a substantial rise in SnakeKeylogger in its Telegram-bot dataset from July onward.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple malware families abusing **Telegram** as a command-and-control and exfiltration channel, highlighting how attackers are repurposing the messaging platform’s bot infrastructure for low-cost, resilient operations. Check Point detailed **ToxicEye**, a multi-function remote access trojan delivered through phishing emails with malicious executables or documents, and said it was observed in more than 130 attacks over a three-month period. Once installed, ToxicEye can steal data, manipulate files, terminate processes, log keystrokes, capture clipboard contents, hijack microphones and cameras, and encrypt files in a ransomware-like manner. The reporting also linked ToxicEye to a broader pattern that includes **Masad Stealer**, another malware family using Telegram to move stolen information and receive operator commands. By relying on a legitimate cloud service, attackers can blend malicious traffic with normal user activity, manage infected hosts anonymously through Telegram bots, and even administer campaigns from mobile devices. The cases underscore a continuing shift toward abuse of trusted consumer platforms to simplify malware deployment, remote control, and data theft.
Aug 15, 2026
Threat intelligence reporting based on **CYFIRMA** research says **Telegram** is increasingly functioning as a high-speed replacement for traditional Tor-based cybercrime forums, enabling threat actors to trade stolen data and coordinate operations with minimal friction. The reporting highlights that, unlike darknet marketplaces that can be dismantled by law enforcement takedowns (e.g., Hydra Market, RaidForums), Telegram channels can be rapidly recreated and audiences redirected via forwarding links, reducing operational downtime for criminal communities. The research describes Telegram channels and bots being used to broker **initial access** into enterprises—advertising access to **corporate VPNs**, **RDP**, and **cloud environments** (including *Azure* and *AWS*)—often supported by “proof” such as screenshots of portals or dashboards. It also notes active commerce in **stealer logs**, **Malware-as-a-Service** offerings (e.g., stealers/loaders sold via subscriptions), and broader ecosystem uses including **ransomware** victim-shaming/leak promotion, affiliate coordination and recruitment, and **hacktivist** coordination, with automation (bots) accelerating search, fulfillment, and payment workflows.
Jun 29, 2026
Multiple reports highlight continued growth in **commercially sold malware**—particularly infostealers and remote-access tooling—lowering the barrier for credential theft and enterprise targeting. Fortinet-described activity shows a **phishing-led Agent Tesla** delivery chain using business-themed lures (e.g., purchase orders), compressed attachments, and obfuscated scripting (e.g., `.jse`) to execute largely **in-memory**, leveraging techniques such as **process hollowing** and anti-analysis to reduce on-disk artifacts and evade endpoint controls while stealing browser, email, and other credentials. Separately, researchers described new or increasingly marketed “as-a-service” tools that expand attacker capability across both Windows and Android. Flashpoint detailed **DarkCloud**, a low-cost infostealer sold via Telegram/clearnet that targets a wide range of browsers and enterprise-adjacent applications (email clients, FTP tools, VPNs), and uses legacy components (e.g., `MSVBVM60.DLL`) to complicate modern detection. Certo reported **Oblivion**, an Android RAT sold via subscription that targets Android 8–16 and emphasizes automated permission bypass and **hidden remote control (HVNC/VNC-like)** functionality alongside SMS/2FA interception and device takeover features. BlackFog reported **Steaelite**, a Windows RAT marketed to enable **double extortion** by combining data theft and ransomware deployment workflows in a single web panel, with HVNC monitoring and an announced Android ransomware module in development. A separate 2025 retrospective from TG Soft’s C.R.A.M. reinforces that **malspam-delivered password stealers** remain prevalent, with **Agent Tesla**, FormBook, and Remcos among the most common families observed in email campaigns.
Jun 29, 2026