Loading story…
A stored cross-site scripting flaw in Telegram Desktop allowed malicious bot inline-keyboard button text to be written unescaped into HTML chat exports. Attackers could forward a poisoned bot message into a target chat without joining it; if a recipient later exported that chat and opened the HTML file in a JavaScript-enabled browser, the embedded payload could execute, exfiltrating rendered messages and metadata, revealing the local export path, altering displayed conversations, or presenting phishing-style verification forms.
The flaw affected Telegram Desktop versions 4.15.1 through 6.9.3 and was reported by ExPatch researchers Denis Rostilov and Aleksander Rostilov on June 3. Telegram added sanitization in version 6.9.4 beta and released the stable fix in version 7.0.1, but exports generated by vulnerable clients remain dangerous: organizations should regenerate affected archives or treat them as untrusted and open them with JavaScript disabled. Researchers reported no evidence of in-the-wild exploitation, and no CVE or official Telegram advisory had been issued.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
After the fix shipped, ExPatch published its writeup describing the Telegram Desktop HTML-export XSS; the researchers said they tested only their own accounts and test groups and found no evidence of exploitation against real users.
Telegram released version 7.0.1, the first stable Telegram Desktop release containing the fix for unescaped inline-keyboard button text in HTML exports.
Telegram Desktop 6.9.4 beta was released with the HTML-export escaping fix, making it the first beta version containing the remediation.
Telegram confirmed ExPatch's vulnerability report and offered the researchers a $500 bug bounty, which they declined and asked to be donated to charity.
ExPatch researchers Denis Rostilov and Aleksander Rostilov reported the stored XSS flaw to Telegram with a proof of concept and video demonstration.
Telegram applied escaping via the SerializeString() sanitization function to inline-keyboard button text, fixing the export injection issue and a separate onclick-handler injection issue.
The vulnerable HTML-export behavior reached stable Telegram Desktop in version 4.15.1, exposing inline-button text to stored XSS in exported chat files.
The HTML export code that wrote bot inline-keyboard button text into output without proper escaping was introduced in February 2024.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcegithub.com
Open sourceexpatch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered a Pastebin-hosted PowerShell script masquerading as **"Windows Telemetry Update"** that steals Telegram session data from Windows systems and exfiltrates it through the Telegram Bot API. The malware targets Telegram Desktop `tdata` files under `%APPDATA%`, gathers host metadata, terminates Telegram to release file locks, compresses the session material into `diag.zip`, uploads it to an operator-controlled bot, and then deletes the archive from disk. Analysis identified two versions of the script: an initial broken build that failed to upload stolen archives and a corrected `v2` that fixed multipart upload logic, added fallback error handling, and sent a beacon even when Telegram was not installed. Investigators also tied the same bot infrastructure to a separate browser-based tool designed to capture Telegram Web `localStorage` authorization data, indicating the operator was developing capabilities to hijack both desktop and web sessions without needing passwords or SMS codes after authentication. Hardcoded bot credentials exposed the attacker’s Telegram bot setup and message history, while a local HTTP collector at `192.168.137.131:5000`, cleartext credentials, and the lack of obfuscation or persistence suggested the tooling was still in active testing and validation rather than broad operational deployment.
Jun 29, 2026
Researchers reported that an updated **XCSSET** malware strain expanded its data-theft capabilities on **macOS**, using malicious AppleScript files to collect and compress sensitive data from multiple applications before exfiltrating it to attacker-controlled infrastructure. The malware was found targeting **Telegram** session data stored in application sandbox and group container directories, creating a path for account takeover on another Mac, while also harvesting information from **Contacts, Evernote, Notes, Opera, Skype, and WeChat**. The updated malware also targeted **Google Chrome** by displaying a fake privilege prompt to obtain the browser’s `safe_storage_key`, which it then used to decrypt and upload stored passwords and other sensitive data. Researchers said the operators rotated multiple command-and-control domains and IP addresses and modified the malware’s Xcode project infection chain so newer variants downloaded payloads remotely instead of embedding additional malicious files locally.
Aug 14, 2026
Researchers reported multiple malware families abusing **Telegram** as a command-and-control and exfiltration channel, highlighting how attackers are repurposing the messaging platform’s bot infrastructure for low-cost, resilient operations. Check Point detailed **ToxicEye**, a multi-function remote access trojan delivered through phishing emails with malicious executables or documents, and said it was observed in more than 130 attacks over a three-month period. Once installed, ToxicEye can steal data, manipulate files, terminate processes, log keystrokes, capture clipboard contents, hijack microphones and cameras, and encrypt files in a ransomware-like manner. The reporting also linked ToxicEye to a broader pattern that includes **Masad Stealer**, another malware family using Telegram to move stolen information and receive operator commands. By relying on a legitimate cloud service, attackers can blend malicious traffic with normal user activity, manage infected hosts anonymously through Telegram bots, and even administer campaigns from mobile devices. The cases underscore a continuing shift toward abuse of trusted consumer platforms to simplify malware deployment, remote control, and data theft.
Aug 15, 2026