Malicious 'Pyronut' Package Backdoors Telegram Bots with Remote Code Execution | Blog | Endor Labs

What it is

pyronut is a malicious PyPI fork of the Telegram MTProto framework pyrogram (about 370,000 monthly downloads). Only three versions were ever published: 2.0.184, 2.0.185 and 2.0.186. All are malicious, and all were published, identified and quarantined on 2026-03-18. The author copied pyrogram's project description verbatim and listed a GitHub URL that does not resolve. Endor Labs reads this as a trojanized fork promoted through Telegram groups, forums or tutorials, not as typosquatting.

How it works

Nothing runs at install time, so there is no setup.py hook to catch. The trigger is a modified Client.start() in pyrogram/methods/utilities/start.py (a file the page says is absent from upstream pyrogram). After get_me(), it imports pyrogram.helpers.secret and calls secret.init_secret(self) inside a bare try/except: pass, so failures are silent.

init_secret() returns early if client.me.id is in OWNERS = [1905813501, 8020909936]. Otherwise it registers two hidden message handlers, restricted to those two user IDs and filtered with ~forwarded and ~via_bot:

• /e <code> evaluates Python in the running client process via meval. It exposes the pyrogram.Client as c, plus the message, the raw API layer and others. The attacker can read messages and contacts, send as the victim, and call any raw Telegram API method.
• /shell <cmd> runs ["/bin/bash", "-c", cmd] through subprocess.run, with the privileges of the Python process.

Command and control runs entirely over Telegram. Output goes back to the same chat, as a file attachment if it exceeds 4096 characters. The attacker can message the victim's bot directly, or any group the bot or userbot is in.

flowchart LR
    A[Attacker account] -->|"/e or /shell"| T[Telegram]
    T --> B[Victim bot or userbot]
    B -->|OWNERS check passes| X[meval or bash -c]
    X -->|output as reply| T

Preconditions / Affected

• pyronut 2.0.184, 2.0.185 or 2.0.186 is installed and a Telegram client has been started (Client.start() ran).
• The attacker can reach the bot, by direct message or through a shared group.
• Exposure is bounded by the hours-long availability window. The page rates exploitation likelihood as relatively low, since the attacker must actively trigger the payload.

What to do

1. Search requirements.txt, Pipfile, pyproject.toml and setup.py for pyronut (the three versions above). Also look for an unexpected meval in the environment, since pyronut pulls it in as a dependency.
2. If found, terminate all active Telegram sessions and revoke any Bot API tokens the process could access.
3. Rotate everything reachable by the process: environment variables, API keys, SSH keys and database passwords. The page says to assume all of them are compromised.
4. Uninstall the package and rebuild the virtualenv from a known-good state, rather than patching in place.
5. Hunt in EDR and system logs for /bin/bash -c <command> child processes spawned by Python. Also review the bot's Telegram message history for /e and /shell messages from the two IDs above.
6. For prevention, use lockfiles with hashes, run SCA in CI, apply least privilege and egress limits, and diff any fork against upstream before adopting it. Red flags here were a dead repository URL and a copied description with no changelog.

Caveats

• There are no network IOCs, because there is no external C2 domain. Detection depends on process and log artifacts, or on what the attacker runs.
• /e activity, such as silently reading Telegram messages, may leave no child processes or network signs. Absence of /bin/bash children is therefore not proof of safety.
• The distribution channel is inferred by Endor Labs, not observed.