44 results for “Telegram”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types44 Write-ups22 Articles13 Repos4 Threads2 Tools2 Advisories1

“Telegram”

socket.devwriteup🛡️ Security

Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets

Socket analysis of three malicious Firefox add-ons impersonating Phantom, Jupiter and Bitget wallets, using Unicode homoglyph names. They steal seed phrases and private keys and send them to brand-named subdomains of bonto[.]io. The Phantom fake adds a runtime loader that fetches and evals a second stage, and bundles a drainer backend with Telegram forwarding. Includes IOCs, hashes and wallet addresses.

FirefoxTelegramCloudflare+3

bonto.ioPhantomJupiter+14

Threat Intel, Malware & RE, Blockchain· Published and added 27 Oct 2026

securityweek.comarticle🛡️ Security

Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016

Prince of Persia (Infy), an Iranian state-sponsored APT active for nearly 20 years, hosted a Tornado second-stage C&C server in the US in July 2026, the first US hosting since 2016, according to Semperis researcher Tomer Bar. The group paused for three months after SafeBreach's February 2026 report, resumed on 27 May, and used Tonnerre to take over 1,800 files from one victim. The server sat on Namecheap shared hosting; on 24 August the group began a replacement behind Cloudflare. Semperis shared IoCs and advises watching for suspicious Telegram traffic.

TelegramCloudflareNamecheap

Prince of PersiaInfyTonnerre+4

Threat Intel· Published and added 23 Oct 2026

microsoft.comarticle🛡️ Security

The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

Microsoft Threat Intelligence maps a Chinese-language cybercrime ecosystem: the YAM Store (Storm-3119), an initial access broker that hijacks Microsoft 365/Azure Education tenants and resells accounts, licenses and SharePoint/OneDrive storage, and the Storm-2990 phishing kits (CoGUI, Haozi, Iron Man System) sold via Telegram. It details the five-stage broker pipeline (app-only client-secret abuse, PnP Management Shell service principal, Graph permissions, Cloudflare DNS management), kit evasion features (geofencing, fake CAPTCHA, WebSocket/Telegram live interaction, 2,335+ templates), downstream device-code phishing and card fraud, and lists mitigations such as passkeys, phishing-resistant MFA and Conditional Access. Microsoft's DCU facilitated a disruption with law enforcement; kits sent over one billion messages since January 2026.

Microsoft 365AzureMicrosoft Entra ID+3

Storm-3119Storm-2990YAM Store+10

Threat Intel, Identity & Access· Published and added 14 Oct 2026

endorlabs.comwriteup🛡️ Security

Malicious 'Pyronut' Package Backdoors Telegram Bots with Remote Code Execution | Blog | Endor Labs

Endor Labs analyzes the malicious PyPI package pyronut (versions 2.0.184–2.0.186), a trojanized fork of the Telegram framework pyrogram. It hooks Client.start() to import a hidden pyrogram/helpers/secret.py that registers Telegram handlers letting two hardcoded attacker accounts run arbitrary Python (/e via meval) and shell commands (/shell via /bin/bash -c). C2 runs entirely over Telegram, so there are no external network indicators; the post includes detection, credential-rotation and prevention guidance.

PyPIPythonTelegram+1

pyronutpyrogrammeval+4

Supply Chain, Malware & RE· Published and added 12 Oct 2026

beaksec.github.iowriteup🛡️ Security

Telegram Desktop vulnerability allowed any user's file to be stolen

Writeup of a two-bug chain in Telegram Desktop: the single-instance local-socket IPC does not escape the semicolon record separator, so a clicked tg:// link injects extra OPEN: commands, which reach the internal interpret: scheme (InterpretSendPath) that reads an arbitrary file and sends it to a chat with no authorization or confirmation. The author plants instruction files via auto-download in a group, then exfiltrates tdata/key_datas and session files (no local passcode means an empty-password KEK) to take over the account. Fixed in 7.2.9 by removing interpret: and escaping separators; the post lists mitigations such as a local passcode and restricting who can add you to groups.

TelegramWindows

db3405699finterpret:InterpretSendPath+4

AppSec, Offensive Security· Published and added 10 Oct 2026

x.comthread🛡️ Security

Dark Web Informer (@DarkWebInformer) on X

Social post announcing a PoC for CVE-2026-107181 in Telegram Desktop before 7.2.9. A crafted tg:// link abuses Telegram's IPC handler to exfiltrate local files, including session keys, which lets an attacker hijack the account without the password. Rated CVSS 8.1 (v3.1) / 8.6 (v4.0), fixed in 7.2.9, with a linked writeup on beaksec.github.io.

TelegramCVSS

CVE-2026-107181tg:// URI handlersession hijacking

AppSec, Offensive Security· Added 10 Oct 2026, published 9 Oct 2026

en.cryptonomist.charticle🛡️ Security

Ledger investigates hardware wallet theft reports; losses estimated above $86M

News report on a suspected supply-chain attack on Ledger hardware wallets sold by the Southeast Asian reseller CryptoBilis. Ledger asked the reseller to suspend sales and shipments, and told buyers from the last 90 days not to initialize devices. Customers who already set up a device should move funds to a new signer with a fresh seed. Onchain investigator Specter estimated more than $86M stolen from hundreds of wallets across Ethereum, TRON and Bitcoin, with 10 addresses listed. The figure is unconfirmed, and there is no evidence that Ledger's hardware or core infrastructure was compromised. The Security Alliance directs victims to its SEAL 911 Telegram bot.

LedgerEthereumTron+1

CryptoBilisSpecterSEAL 911+3

Supply Chain, Blockchain· Published and added 9 Oct 2026

github.comrepo🧠 AI

Tracer-Cloud/opensre

OpenSRE is an open-source framework for building AI SRE agents that resolve production incidents by correlating logs, metrics, traces, deploys and runbooks across 60+ connected tools (observability, cloud infra, incident management, MCP). Beyond the agent runtime (CLI, Python API, Slack/PagerDuty/Telegram integrations), the project's stated mission is to build an RL training and evaluation environment — explicitly modeled on SWE-bench's role for coding agents — to scale realistic infrastructure-failure scenarios as a benchmark for AI SRE.

DockerPythonPostgreSQL+3

OpenSRETracer-CloudSWE-bench

agents, evals, ai-infra· Added 8 Oct 2026

huntress.comwriteup🛡️ Security

Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs

Huntress details a phishing campaign that abuses legitimate Microsoft Power BI dashboards (app.powerbi.com) to host a fake "Download Reference" lure that bypasses mail filters trusting the Microsoft domain. Clicking the lure triggers browser/environment fingerprinting and Telegram-bot-based victim telemetry exfiltration via attacker domains (dailylifeproject.site, burnsworth.site, etc.), then silently downloads rogue ScreenConnect installers; a chained CMD/PowerShell script (SCAutoFix.ps1) deploys a second ScreenConnect instance, uninstalls the first for evasion, drops the defense-evasion tool HideUL_x64.exe, and sets a recurring scheduled task before Huntress's SOC intervened.

Power BIScreenConnectTelegram+3

HideUL_x64.exeSCAutoFix.ps1SCAutoRepairEvery2Min

Threat Intel, Blue Team & Detection· Published and added 7 Oct 2026

rapid7.comarticle🛡️ Security

The ASOS Incident: When Attackers Use the Channels Customers Trust

Rapid7 analyzes the ASOS incident, in which attackers sent a hostile push notification through ASOS's own mobile app claiming its Snowflake environment was compromised and directing customers to a Telegram channel; ASOS confirmed unauthorized access to third-party customer-communication platforms and possible exposure of names/contact details, while Snowflake denied any platform compromise. The piece argues that abusing a legitimate, trusted app/channel defeats typical phishing-awareness heuristics (odd sender, wrong domain) and makes the case for MDR that correlates identity, SaaS, and cloud-integration activity across providers to catch misuse of legitimate access rather than relying on known-bad indicators.

SnowflakeTelegram

ASOS

Threat Intel, Blue Team & Detection· Published and added 7 Oct 2026

securityweek.comarticle🛡️ Security

ASOS Confirms Cyberattack, Data Breach

ASOS confirmed attackers compromised a third-party platform used for customer communications, sending UK users rogue mobile notifications claiming "we have fully compromised the Snowflake instance" and threatening to leak data unless engaged. ASOS says only basic user info (names, contact details) may have been exposed, with no impact to payment cards or passwords. A newly surfaced group calling itself Xuanye Group claimed the attack on Telegram; researchers note the extortion-via-direct-notification tactic and possible Snowflake angle mirror the 2024 ShinyHunters mass-extortion campaign against Snowflake customers.

Snowflake

Xuanye GroupShinyHunters

Threat Intel· Published and added 7 Oct 2026

decrypt.coarticle🛡️ Security

Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers

Decrypt reports on ZachXBT's account of infiltrating a Chinese money-laundering syndicate working for North Korea's Lazarus Group, by posing as a client ("fronted" $349.7K USDC) to a contact named "Jimmy Green" to gather intelligence on how Bybit's $1.5B hack proceeds were being laundered. The piece details the on-chain corroboration methods used (matching Telegram screenshots to Thorchain swap timing, wallet clustering across BTC/ETH/SOL/Tron) that exposed a $12M+ cluster of Bybit exploit funds, led to a 442K USDT Tether freeze, and separately traced $3M in fraud proceeds to Huione Guarantee, a Cambodian marketplace later targeted by FinCEN and shut down by Telegram.

EthereumSolanaTron+3

ZachXBTLazarus GroupDPRK+12

Threat Intel, OSINT, Blockchain· Published and added 5 Oct 2026

protos.comarticle🛡️ Security

ZachXBT poses as money launderer to infiltrate Lazarus network

Crypto investigator ZachXBT details how he posed as a money-laundering client (contacting a launderer known as "Jimmy Green" over Telegram/Discord) to infiltrate a Chinese organized-crime network laundering funds for North Korea's Lazarus Group. He fronted roughly 350,000 dollars across transactions, collected addresses and bridging methods via THORSwap, and used the intel to link the launderer to the 1.5 billion dollar Bybit hack, the 100 million dollar Poloniex hack, and sanctioned conglomerate Huione Guarantee; findings also contributed to freezing funds tied to the Bybit theft.

ZachXBTLazarus GroupBitget+5

Threat Intel, OSINT, Blockchain· Published and added 5 Oct 2026

checkmarx.comwriteup🛡️ Security

MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work

Checkmarx's research team documents MALFEX, an npm supply-chain malware campaign run by a single operator ("Murizada") publishing since August 2023, with 12 packages (8 malicious), three still live as of late September/October 2026. The campaign delivers three distinct Windows payloads: Overlord RAT (a Go-based C2 that reads its server address from encrypted Solana blockchain transactions and uses process hollowing into TapiUnattend.exe), the movinlike Node.js stealer (targeting Discord, browser credentials, Telegram, and crypto wallets, exfiltrating via Discord webhook), and a long-running downloader hidden in function-flag's postinstall script. The writeup includes full IOCs, file hashes, host artifacts, detection commands, and remediation guidance for compromised Windows hosts.

npmNode.jsWindows+3

MALFEXOverlord RATmovinlike+10

Supply Chain, Malware & RE, Threat Intel· Added 7 Oct 2026, published 5 Oct 2026

solana.comtool🛡️ Security

Introducing Solana Microscope: Program Monitoring and Alerts

Microscope is an open-source, self-hosted monitoring and alerting tool for Solana programs that decodes a program's instructions and events using its IDL, then renders that activity as Grafana dashboards backed by Loki (logs) and Prometheus (metrics). It can also watch a Squads multisig controlling the program, firing precise alerts on specific instructions, events, field values, or multisig proposal approvals to Slack, Telegram, or PagerDuty. A distinguishing feature is built-in health alerting for the monitoring pipeline itself (stalled gRPC/RPC streams, corrupt checkpoints, records decoded but not reaching Loki), so teams can distinguish "program is quiet" from "monitoring is broken." It deploys via Docker Compose, Terraform (AWS/GCP), or Kubernetes manifests, and the code is MIT-licensed on GitHub.

SolanaGrafanaPrometheus+3

Squads

Blue Team & Detection· Added 8 Oct 2026, published 5 Oct 2026

x.comthread🧠 AI

duyet (@_duyet) on X

AI;DR is an open-source automated pipeline that scrapes AI news from 20+ sources daily, then uses an LLM (routed through AnyRouter) to rank and summarize the stories into a single edition, publishing it to a website, email newsletter, and Telegram channel. It's hosted on Cloudflare and the creator notes it was largely built and is maintained by AI agents. The tool is a concrete example of using LLM-based ranking/summarization to turn a noisy multi-source feed into one curated digest.

Cloudflare

AI;DRAnyRouterJev

llm-apps· Published and added 1 Oct 2026

hackread.comarticle🛡️ Security

MALFEX npm Attack Spreads Windows RAT, Steals Discord and Browser Data

CloudSEK's Global Threat Intelligence team uncovered MALFEX, a supply-chain campaign active since August 2023 that uses malicious npm packages (including tlxbnhd, tldriver, mxdriver, img-to-native, cdn-img-fetch, function-flag, function-color) to deliver malware on Windows. One chain disguises a Windows executable as a PNG to load Overlord RAT, an open-source Go-based RAT that uses the Solana blockchain to resolve C2 addresses; a second chain fetches a 64MB Node.js bundle that steals Discord tokens, browser cookies/credentials, crypto wallets and Telegram session data, exfiltrating via a Discord webhook. Some malicious packages stayed live for over a year even after related packages were pulled or flagged.

npmNode.jsSolana+3

MALFEXOverlord RATcavecrew+8

Supply Chain, Threat Intel, Malware & RE· Added 3 Oct 2026, published 30 Sep 2026

x.comrepo🛡️ Security

Andrea (Drego) Draghetti 👨🏻‍💻 🎣 (@AndreaDraghetti) on X

Tosint v1.0.0 is an open-source Telegram OSINT tool for analyzing bots and chats, exporting message history and media. The new release adds richer JSONL metadata output, optional SHA-256 hashing of exported media, bot/user authentication support, and an automatic fallback from MTProto-based history retrieval to ID-scan mode when dealing with restricted chats.

TelegramTosint

Andrea Draghetti

OSINT· Added 2 Oct 2026, published 30 Sep 2026

group-ib.comwriteup🛡️ Security

HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack

Group-IB documents previously undocumented samples of HEAVYGRAM, a Python/PyInstaller-based Windows backdoor that uses the Telegram bot API for command-and-control, screen/audio capture, data exfiltration, and DLL side-loading, alongside the related CRUDEEXCLUDE loader that adds Windows Defender exclusions. The research corroborates and extends a March 2026 US DOJ affidavit and FBI FLASH report, attributing the malware with moderate confidence to the Handala Hack persona — assessed as a false-flag "hacktivist" front for Void Manticore (aka Storm-0842/Banished Kitten), operating on behalf of Iran's MOIS — used since Fall 2023 against Iranian dissidents, journalists, and critics of the Iranian government via Telegram-delivered, Delphi-packaged lures (fake KeePass, Telegram, Pictory apps). It details four infection-chain variants (WSF/VBS downloaders, HTA Telegram-polling scripts, Delphi droppers with embedded archives), the implant's command prefixes (@@/**/##) and attachment handlers, dual-bot C2 configurations, and provides IOCs and detection/hardening recommendations.

TelegramPowerShellPython+3

Handala HackVoid ManticoreStorm-0842+12

Threat Intel, Malware & RE· Added 1 Oct 2026, published 17 Sep 2026

huntress.comwriteup🛡️ Security

Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware

Huntress SOC analysts Ryan Dowd and Jon Semon tore apart a live social-engineering campaign that began with a fake CoinDesk marketing exec DMing a researcher a Google Doc containing a container-bound Apps Script sidebar. The script ran client-side without OAuth consent, exfiltrated victim IP/geolocation/wallet presence via the Telegram API, then routed macOS users to a piped zsh/DMG AMOS stealer chain and Windows users through ClickOnce and PowerShell loaders using three stolen or fraudulent code-signing certificates (a Norwegian company, Discord, and Lenovo). The Windows chain culminated in NetSupport Manager RMM abuse, a Ledger wallet implant, and a self-generated rogue root certificate authority (spoofing Google Trust Services) installed via MsBuild.exe hollowing to silently intercept HTTPS traffic, which the authors flag as the artifact most likely to survive incident remediation short of full reimaging.

WindowsmacOSGoogle Workspace+3

AMOS stealerClickFixMacSync+6

Threat Intel, Malware & RE· Added 11 Sep 2026, published 15 Sep 2026

chainalysis.comarticle🛡️ Security

OFAC and DOJ Strike Xinbi, a Multibillion-Dollar Marketplace for Cybercriminals

Chainalysis details the OFAC/DOJ sanctioning and seizure action against Xinbi Guarantee, a $24B Chinese-language Telegram-based marketplace connecting money laundering, scam infrastructure, stolen data, and KYC-bypass vendors. The piece maps Xinbi's escrow model and vendor ecosystem, and traces how DPRK-linked actors used specialized 'Black U' launderers to swap traceable stolen funds from the Bybit ($1.5B) and WazirX ($235M) hacks for cleaner stablecoins sourced from pig-butchering and romance-scam proceeds, ultimately leading to $52M in restrained cryptocurrency across 49 wallets.

DPRKXinbi GuaranteeSafeW Technology+4

Threat Intel, Blockchain· Added 30 Sep 2026, published 9 Sep 2026

aikido.devwriteup🛡️ Security

Compromised Flutter package on pub.dev contains XCSSET malware

Aikido Security discovered a variant of the XCSSET macOS worm hidden in universal_file_viewer, a Flutter file-preview package on pub.dev (~500 downloads) — the first compromised package found on that registry. The infection was not a targeted supply-chain attack but resulted from the maintainer's machine being infected with XCSSET, which auto-injects malicious build hooks into every Gradle, Xcode, and git project it finds; the poisoned example/ directory (Android Gradle build, iOS/macOS Xcode project files) shipped in the package tarball. The writeup details XCSSET's four-stage infection chain, its android_finder/git_finder/replicator_finder propagation modules, Launchpad-tile persistence, and theft modules targeting Chrome, Safari, Firefox, Telegram, Notes, and clipboard data, plus C2 domain and file-artifact IOCs.

Flutterpub.devmacOS+3

XCSSETuniversal_file_viewer

Supply Chain, Malware & RE· Published and added 8 Sep 2026

github.comrepo🛡️ Security

kaandemir993/DarkTortilla-RAT-Telegram-Exfiltration-Payload-Extraction-Analysis

A hands-on reverse-engineering writeup dissecting a DarkTortilla RAT sample (pulled from MalwareBazaar) using Process Hacker, Binary Ninja and x64dbg. It documents the malware's credit-card theft (card_number_encrypted strings for Visa, Mastercard, Amex, Diners Club, etc.), browser credential theft via SQLite queries against Login Data files and app_bound_encrypted_key/os_crypt decryption, and three parallel exfiltration channels — a Telegram bot, SMTP mail, and FTP upload — with the C2 domain showip.net used for IP detection.

SQLiteTelegramWindows+3

DarkTortilla RATMalwareBazaar

Malware & RE, Threat Intel· Added 30 Sep 2026, published 5 Sep 2026

github.comrepo🛡️ Security

Rekono

Rekono is an open-source pentesting automation platform that chains 19 hacking tools (Nmap, Nuclei, Metasploit, OWASP ZAP, Nikto, Gitleaks, SearchSploit, etc.) so that output from one tool feeds the next, automatically covering recon, service enumeration, vulnerability scanning, and exploit correlation. It deduplicates findings into a single attack-surface inventory per host/port, enriches CVEs with community context for prioritization, tracks fixed/reopened vulnerabilities, and supports team collaboration, scheduled scans, Telegram/email alerts, and report generation for engagements.

NmapMetasploitNuclei+3

Offensive Security· Added 3 Sep 2026, published 27 Aug 2026

opensourcemalware.comwriteup🛡️ Security

Windows Infostealer Hits npm and Ruby

Follow-up analysis showing that the RubyGems StubMaker typosquatting campaign and a separately-discovered 40-package npm typosquatting campaign (targeting chalk, commander, lodash, typescript, react, axios) are run by the same threat actor: both use install-time hooks (extconf.rb vs postinstall.js) to fetch a Rust loader from the same GitHub release, which decrypts a byte-for-byte identical Go infostealer confirmed by matching SHA-256 hashes. The stealer harvests browser credentials (bypassing Chromium app-bound encryption), crypto wallets/seed phrases, and Telegram data, exfiltrating via Gofile to a webhook at dresslee.com, and includes WSL-to-Windows sandbox escape logic. The post publishes full network/file IOCs and hashes and argues network-layer blocking (C2 IP and webhook domain) is more durable than package-name blocklisting.

npmRubyGemsRust+3

StubMakerdresslee.comOpenHack

Supply Chain, Threat Intel· Added 3 Sep 2026, published 19 Aug 2026

huntress.comwriteup🛡️ Security

MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer

Huntress SOC analysts reverse-engineer MacSync, a macOS infostealer/RAT distributed via a sponsored Google Ads link to a fake "Apple Support"-branded claude.ai shared conversation that uses ClickFix to trick victims into pasting a curl/zsh loader into Terminal. The six-stage chain runs a polymorphic gzip/Base64 loader, an in-memory AppleScript stealer that harvests Chromium Safe Storage keys, keychain secrets, Telegram/SSH/cloud credentials, abuses TCC (Full Disk Access and Screen Recording) prompts, drops a Mach-O RAT with WebSocket/TLS C2 and an XOR-obfuscated fallback domain, and trojanizes 84 crypto wallet extensions/apps to phish seed phrases. The piece also compares it to prior AMOS Stealer and SectopRAT ClickFix campaigns and offers behavior-based detection guidance.

macOSAppleScriptzsh+3

MacSyncClickFixSectopRAT+2

Malware & RE, Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 17 Aug 2026

opensourcemalware.comwriteup🛡️ Security

StubMaker RubyGems Campaign Delivers a Windows Infostealer

Researchers identified "StubMaker," a RubyGems typosquat campaign (brumdler, brundlef, and 15 packages typosquatting bundler/i18n/rake/activesupport) that abuses the extconf.rb native-extension hook to fake a successful build while beaconing victim OS info and, on Windows, downloading a Rust loader (main.exe) from a GitHub release. The loader decrypts an embedded 11MB Go infostealer entirely in memory, which injects an embedded DLL (abe_payload.dll) into Chromium browsers via the elevation-service COM object to defeat Application-Bound Encryption and steal passwords, cookies, payment cards, crypto wallets/seed phrases, and Telegram data, exfiltrating via Gofile and a webhook at dresslee.com. The piece also details how RubyGems.org's namespace-reclaim behavior let a different account (mod8rz41mje) take over the yanked "brumdler" name to relaunch the campaign, and includes full IOCs and hashes.

RubyGemsGoRust+4

gemlewqqhu1mod8rz41mjerbq95bwt6q+7

Supply Chain, Malware & RE, Threat Intel· Added 3 Sep 2026, published 16 Aug 2026

socket.devwriteup🛡️ Security

Socket: 737 Malicious VPN/Proxy Chrome Extensions Impersonate 66 Brands

Socket's Threat Research Team documents a 737-extension Chrome Web Store campaign ('Myxa VPN' / Муха VPN) that impersonates 66 legitimate VPN/privacy brands (Proton VPN, NordVPN, AmneziaVPN, AntiZapret, Cloudflare 1.1.1.1, etc.) to lure Russian-speaking users seeking censorship circumvention. The extensions force all browser traffic through a shared SOCKS5 proxy pool via chrome.proxy.settings, evade DNS-based blocklists using DNS-over-HTTPS to resolve proxy hosts, sell non-existent premium server locations, ship fake license checks, add remote-configuration code post-approval, and submit false 'no data collection' justifications to Chrome reviewers. The report ties the operation to a single Russian self-employed-registered VPN business via shared Yandex Metrika counters, build-path leakage, bulk domain registration, and a Telegram-based billing dashboard, and notes 516 of the 737 extensions remain live despite prior Palo Alto Networks disclosure.

ChromeChrome Web StoreTelegram+2

T1176.001T1557T1090.002+15

Threat Intel, Supply Chain· Published and added 12 Aug 2026

hackers-arise.comarticle🛡️ Security

Python OSINT Toolkit for Telegram

A Hackers-Arise walkthrough for building a custom Telegram OSINT toolkit in Python using Telethon's MTProto API instead of the limited Bot API, enabling full message-history access, group member enumeration (up to 200/request), and message/engagement metadata collection. The toolkit also extracts EXIF/GPS metadata from downloaded media (via Pillow/piexif) to geolocate targets, persists results in SQLite via aiosqlite, and exposes everything through a Click CLI with modules for profile, members, messages, and media lookups.

PythonTelegramKali Linux+2

OSINT· Added 3 Sep 2026, published 31 Jul 2026

bbradar.iotool🛡️ Security

BBRadar

BBRadar is a dashboard that aggregates and compares public bug bounty programs across multiple platforms by reward, scope, and listing date, covering web, mobile, source code, and smart contract targets with links to official program policies. It also tracks scope changes and pushes rule-matched alerts to Telegram, with additional shared updates for Pro users in Discord, letting bounty hunters spot newly in-scope targets quickly.

Offensive Security· Added 3 Sep 2026, published 18 Jul 2026

socket.devwriteup🛡️ Security

Socket: Operation Muck and Load

Socket details "Operation Muck and Load," a campaign starting with a malicious Go module (github.com/kaleidora/dnsub-scanning-tool) that impersonates a DNS scanner but launches hidden PowerShell to fetch and decode a multi-layer, XOR-encrypted loader. The loader resolves encrypted payload locations from public dead drops (Pastebin, GitHub, YouTube, Instagram, Telegram, Google Docs), retrieves a password-protected .7z archive masquerading as Microsoft Photos, and deploys AsyncRAT/Quasar/Remcos-style RATs and Vidar infostealer. Pivoting from the module, Socket uncovered 222 GitHub repositories across 190 accounts using automated force-push workflows tied to a single email (ischhfd83@rambler.ru) to fake activity and credibility, some directly hosting Vidar, XMRig/BitMiner, and trojan loaders.

GoGitHubGitHub Actions+3

ischhfd83@rambler.ruAsyncRATQuasar+9

Supply Chain, Threat Intel, Malware & RE· Published and added 16 Jul 2026

socket.devwriteup🛡️ Security

Socket: 11 Malicious NuGet Tools Pose as Game Cheats

Socket's Threat Research Team analyzed 11 malicious NuGet DotnetTool packages (published by account pepegit666) that impersonate game cheats/bots for titles like GTA5RP, Albion Online, and Throne and Liberty. Each package's .NET downloader resolves GitHub hosts via DNS-over-HTTPS, requests UAC elevation to resync the clock, and fetches a PyInstaller Windows payload (pepesoft.exe) from GitHub Releases/Hugging Face with dormant BitTorrent fallback code, that in turn authenticates to Google Sheets for telemetry, hardware-binds licenses, enforces a remote HWID ban-list, and, in three samples, drives Telegram bot commands that exfiltrate screenshots and modify Windows Installer registry keys on exit. The report includes full IOC lists (hashes, domains, hardcoded AWS-style keys, mutex GUID) and MITRE ATT&CK technique mappings.

NuGet.NETWindows+5

pepegit666pepesoft.exePepesoft+16

Supply Chain, Malware & RE, Threat Intel· Published and added 15 Jul 2026

socket.devwriteup🛡️ Security

jscrambler npm Package Compromised in Supply Chain Attack

Socket's research team documents a supply chain compromise of the jscrambler npm package (v8.14.0+), where a stolen publishing credential was used to push malicious releases that drop platform-specific Rust-built infostealer binaries via a preinstall hook. The campaign evolved over the incident to evade scanners by moving the dropper from install scripts into a self-executing function inside index.js/CLI code (defeating --ignore-scripts), and the payload targets crypto wallets, cloud credentials (AWS/GCP/Azure), browser data, Discord/Slack/Telegram, and notably AI coding assistant configs (Claude Desktop, Cursor, Windsurf, VS Code) for MCP server credentials. Includes detailed RE of the ChaCha20-Poly1305 string-encryption scheme and full IOC hash list.

JscramblernpmRust+3

Supply Chain, Malware & RE· Added 21 Sep 2026, published 11 Jul 2026

huntress.comarticle🛡️ Security

LoTL Abuse: How to Spot It vs. Normal Admin Activity | Huntress

Huntress SOC breaks down how to differentiate legitimate admin use of native tools (PowerShell, WMI, RMM software) from living-off-the-land (LoTL) abuse by attackers, offering a four-point pressure test: who used the tool, where it ran, how it launched, and what followed. It includes real detection examples such as attackers using the legitimate RMM tool Action1 to deploy ScreenConnect for persistent access, a malicious process chain spawning from bomgar-scc.exe, and an LLM-generated script with code comments revealing Telegram-based exfiltration.

PowerShellWMIScreenConnect+2

bomgar-scc.exe

Blue Team & Detection, Threat Intel· Added 3 Sep 2026, published 8 Jul 2026

huntress.comwriteup🛡️ Security

Meta Phishers Abuse Business Account Manager Service | Huntress

Huntress researchers analyzed a phishing campaign that abused Meta's legitimate "Business Partner Manager" email feature (from security@facebookmail.com) to send convincing phishing lures that bypass typical email validation checks. The threat actor injected a URL into the field meant for a partner's business name, redirecting victims through Google Sites, a fake "Meta Agency Partner Program" page (aussiecleaningservices[.]com), and later a Facebook Messenger chatbot ("AI Strategic Partner") leading to a fake Meta Verified/Content Monetization phishing page (sw[.]run, framed via Netlify) that harvested credentials, MFA codes, and ID documents, exfiltrating them to a Telegram bot with Vietnamese-language text, before Meta shut down the abuse vector.

TelegramCloudflare

God of Wealth arrivesdata1mdobot@bulondondam+4

Threat Intel, Identity & Access· Added 3 Sep 2026, published 7 Jul 2026

advisories.gitlab.comadvisory🛡️ Security

AI Security Briefing

CVE-2026-52830 describes a path traversal flaw in fast-mcp-telegram, a PyPI package exposing Telegram as an MCP server, where HTTP Bearer tokens are joined directly into a session-file path without normalization. The verifier blocks the literal reserved token "telegram" but not path separators, so a token like "../fast-mcp-telegram/telegram" lets a remote HTTP client authenticate as the default legacy session, bypassing the control meant to keep multi-user HTTP sessions from colliding with the default stdio/legacy account. Account-prefixed MCP tool naming does not prevent the bypass since prefixed tools for the compromised default account remain accessible.

PyPITelegramModel Context Protocol+1

CVE-2026-52830path traversal

AppSec· Published and added 5 Jul 2026

sentinelone.comwriteup🛡️ Security

macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox

SentinelLABS dissects macOS.Gaslight, a Rust macOS implant (tracked via Apple XProtect's MACOS_BONZAI_COBUCH rule, linked to DPRK-aligned BONZAI/AIRPIPE activity) that uses a Telegram Bot API polling channel with AES-GCM-over-pinned-TLS, self-redacts its bot token from runtime logs, stages a runtime-fetched standalone CPython interpreter to run a Python keychain/browser/history stealer, and persists via a fake com.apple.* LaunchAgent. Its standout feature is a 3.5 KB embedded block of 38 fabricated "system" messages mimicking an LLM triage harness's prompt scaffold, engineered to make an AI-assisted analyst tool abort or refuse analysis rather than evade the sandbox itself.

RustmacOSTelegram+2

DPRKmacOS.GaslightBONZAI+8

Malware & RE, AI Security, Threat Intel· Added 26 Jun 2026, published 23 Jun 2026

opensourcemalware.comarticle🛡️ Security

The Software Supply Chain Malware Landscape: January - May 2026

OpenSourceMalware analyzes its threat database (166,000+ records) to surface three supply-chain malware trends for Jan 1-May 18 2026: npm and PyPI malicious-package growth is now tracking at similar velocity (driven by dual-ecosystem campaigns like Contagious Interview and a Telegram-exfiltration infostealer cluster), account takeovers (led by TeamPCP's Trivy compromise and Mini Shai-Hulud campaign) are rising but coexist with more surgical dependency-confusion/typosquat attacks like Stardrop and events-channel, and malicious ClawHub AI-skill submissions (707 analyzed) increasingly target non-developer roles such as marketing and sales alongside the usual crypto and developer victims. The piece uses download-count as a proxy to distinguish ATO from born-bad malicious packages and highlights under-monitored non-engineer credential exposure as an emerging risk.

npmPyPIaxios+2

TeamPCPMini Shai-HuludContagious Interview+4

Supply Chain, Threat Intel, AI Security· Added 3 Sep 2026, published 3 Jun 2026

theravenfile.comwriteup🛡️ Security

GITHUB LEAK: YOUR CODE @ RISK! – THE RAVEN FILE

Analysis of a claimed BreachForums leak by threat actor TeamPCP of ~4K GitHub private repositories, including two leaked Rails controller files (OrganizationsController, PullRequestsController) that the author dissects for internal architecture details — OFAC/trade-compliance gating, CAPTCHA logic, org deletion "danger zone" tokens, database cluster topology, Voltron graceful-timeout feature flags, PR stacking, and JA3-TLS-fingerprint-based anonymous rate limiting. The piece also links TeamPCP to a lookalike domain (git-service.com, registered May 16 2026) used to compromise Microsoft's durabletask Python package, and notes TeamPCP's dark-web/Telegram presence and ties to CypherForce Ransomware.

GitHubRuby

TeamPCPLazarus GroupBlueNoroff+4

Threat Intel, Supply Chain· Added 5 Sep 2026, published 20 May 2026

huntress.comarticle🛡️ Security

How EvilTokens Turbocharges Old School Phishing with AI

Huntress and Microsoft detail EvilTokens, a phishing-as-a-service (PhaaS) platform sold on Telegram for ~$1,500 that automates OAuth device code phishing to steal valid session tokens and bypass MFA entirely, relaying attacks through the Railway PaaS. The kit integrates AI to generate role-specific, contextually accurate lures, dynamically generate device codes to remove timing constraints, and automatically draft follow-on wire-fraud emails in the victim's own voice after mailbox compromise — a campaign that hit 344 organizations across five countries in 16 days and evaded Cisco Secure Email, Trend Micro, and Mimecast. The piece also covers sibling PhaaS kits (Tycoon2FA, BlueKit, Kali365) and recommends conditional access restrictions, phishing-resistant FIDO2/passkey MFA, and refresh-token revocation as mitigations.

Microsoft Entra IDTelegramRailway

EvilTokensTycoon2FABlueKit+3

Threat Intel, Identity & Access, AI Security· Added 3 Sep 2026, published 11 May 2026

kenhuangus.substack.comwriteup🛡️ Security

OpenClaw MAESTRO

A researcher applies the MAESTRO 7-layer agentic AI threat model (Foundation Models, Data Operations, Agent Frameworks, Deployment/Infra, Evaluation/Observability, Security & Compliance, Agent Ecosystem) to the OpenClaw messaging-bot agent codebase, cataloging ~30 numbered threats with specific file references (e.g. prompt injection via WhatsApp/Telegram/Discord channels in src/channels/, plaintext credential storage in pairing-store.ts, Docker socket exposure in sandbox configs, gateway loopback-binding bypass, ClawHub skill registry poisoning) alongside existing and recommended mitigations. It closes with a cross-layer chained attack scenario (gateway compromise → session store poisoning → context manipulation → sub-agent hijack → ecosystem spread) illustrating defense-in-depth across layers.

OpenClawDockerNode.js+1

MAESTRO FrameworkClawHub

AI Security· Published and added 6 May 2026

huntress.comwriteup🛡️ Security

Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure

Huntress details a device-code phishing campaign hitting 340+ Microsoft 365 tenants across the US, Canada, Australia, New Zealand, and Germany since February 2026, in which attackers abuse Railway.com's clean-IP PaaS infrastructure to run OAuth device-code token replay at scale, bypassing MFA entirely. The campaign chains vendor URL-rewriter abuse (Cisco, Trend Micro, Mimecast), compromised sites, Cloudflare workers.dev phishing pages, and AI-assisted lure generation, and Huntress has attributed it to the EvilTokens Phishing-as-a-Service platform advertised via Telegram. The post includes IOCs (Railway CIDR ranges), Sentinel KQL hunting queries, and mitigation guidance (block Railway IPs, revoke refresh tokens, restrict device code flow, enable CAE).

RailwayMicrosoft 365OAuth+3

EvilTokensNOIRLEGACY GROUPBAV2ROPC

Threat Intel, Identity & Access, Offensive Security· Added 3 Sep 2026, published 23 Mar 2026

huntress.comwriteup🛡️ Security

How Threat Actors Abuse Remote Management Tools | Huntress

Huntress details how low-skill threat actors daisy-chain legitimate RMM tools (ScreenConnect, Action1, HeartbeatRM, AnyDesk, Atera, etc.) via invitation and Social Security themed lures, LLM-generated infostealer scripts, and multi-fallback browser download tricks hosted on GitHub repos (VH851, Drasticc) to gain and disguise persistent access. It also documents firsthand observation of an actor who signed up to Huntress itself, revealing their toolchain (DeepSeek, Email Extractor, Proxy SwitchyOmega, 9Proxy, CertifyTheWeb, Sordum Hide from Uninstall List, and a fake Windows Security PIN harvesting binary pin.exe) and victim data such as W-9 forms and SSNs collected via Telegram based exfiltration.

ScreenConnectAction1HeartbeatRM+3

VH851Drasticcpin.exe+3

Threat Intel, Offensive Security· Added 3 Sep 2026, published 11 Mar 2026

huntress.comwriteup🛡️ Security

Reflecting on AI in 2025: Faster Attacks, Same Old Tradecraft

Huntress reviews four 2025 intrusions where adversaries used LLMs (ChatGPT, DeepSeek, Gemini) to draft PowerShell tradecraft: an RDP-brute-forced credential dumper, a Veeam credential-theft script (v.ps1) over WinRM, an iterated Chrome/Edge history-scraping script chain (qb_check.ps1 → coinbase_check.ps1 → secure.chase.ps1) exfiltrating to Telegram, and a fully-featured Chrome extension RAT ("Telegram Agent + Cookies") beaconing to a C2 for cookie/screenshot/history exfiltration. The pattern across cases: AI speeds up authoring (odd comments, Cyrillic strings, verbose AI-style formatting) but doesn't produce novel primitives, so existing detections (EDR, telemetry, MFA, segmentation) still catch it.

HuntressPowerShellScreenConnect+5

Telegram Agent + Cookiesqb_check.ps1coinbase_check.ps1+2

Threat Intel, Blue Team & Detection, AI Security· Added 3 Sep 2026, published 12 Jan 2026