🧰 Telegram

The items that name it 50

• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
  writeupas tools2026-10-31

  Channel through which the operator receives ranked target assessments

• Israel Extradites Alleged Nomad Bridge Exploiter to US Over $2.8M Theft: Report
  articleas classification.technologies2026-10-30
• Earliest Known PolinRider Malware Found in 2025 npm Packages
  writeupas classification.technologies2026-10-30
• Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets
  writeupas classification.technologies2026-10-27
• Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
  articleas affected products2026-10-23It is written here as Telegram (bot used by Tornado to exfiltrate stolen files).

  bot used by Tornado to exfiltrate stolen files

• “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities
  writeupas tools2026-10-21

  Interface for Hermes profiles, each running as a separate bot gateway

• The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
  articleas classification.technologies2026-10-14
• Malicious 'Pyronut' Package Backdoors Telegram Bots with Remote Code Execution | Blog | Endor Labs
  writeupas classification.technologies2026-10-12
• Telegram Desktop vulnerability allowed any user's file to be stolen
  writeupas classification.technologies2026-10-10
• Dark Web Informer (@DarkWebInformer) on X
  threadas classification.technologies2026-10-09
• Malicious npm Campaign “MALFEX” Delivers RAT and Stealer via Eight Packages with 40,000+ Downloads
  articleas affected products2026-10-08

  Session data stolen by movinlike Stealer

• Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
  writeupas classification.technologies2026-10-07
• The ASOS Incident: When Attackers Use the Channels Customers Trust
  articleas classification.technologies2026-10-07
• Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers
  articleas classification.technologies2026-10-05
• ZachXBT poses as money launderer to infiltrate Lazarus network
  articleas classification.technologies2026-10-05
• Introducing Solana Microscope: Program Monitoring and Alerts
  toolas tools2026-10-05

  Alert notification channel

• MALFEX npm Attack Spreads Windows RAT, Steals Discord and Browser Data
  articleas classification.technologies2026-09-30
• Andrea (Drego) Draghetti 👨🏻‍💻 🎣 (@AndreaDraghetti) on X
  repoas affected products2026-09-30

  Platform targeted by Tosint for bot and chat analysis, including restricted Telegram chats

• Socket: Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
  writeupas tools2026-09-20

  Used by the Python stealer to exfiltrate a document when C2 supplies a bot token and chat ID.

• HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack
  writeupas affected products2026-09-17

  Messaging application abused as delivery vector (victims contacted via Telegram) and as command-and-control/exfiltration channel via its bot API; legitimate service misused by threat actors, not itself vulnerable.

• Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware
  writeupas classification.technologies2026-09-15
• Socket: Malicious Extensions Drain Axiom Trade and Padre Crypto Sessions
  writeupas classification.technologies2026-09-12
• The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment
  articleas classification.technologies2026-09-11
• OFAC and DOJ Strike Xinbi, a Multibillion-Dollar Marketplace for Cybercriminals
  articleas tools2026-09-09

  Messaging platform hosting hundreds of Chinese-language channels used by Xinbi vendors to advertise money laundering services, scam websites, stolen data, and recruitment; channels seized under federal court authorization on September 7, 2026

• Compromised Flutter package on pub.dev contains XCSSET malware
  writeupas classification.technologies2026-09-08
• kaandemir993/DarkTortilla-RAT-Telegram-Exfiltration-Payload-Extraction-Analysis
  repoas classification.technologies2026-09-05
• Rekono
  repoas classification.technologies2026-08-27
• Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
  writeupas tools2026-08-19

  Used by the malicious Apps Script to report victim/host information back to the actor

• Windows Infostealer Hits npm and Ruby
  writeupas classification.technologies2026-08-19
• MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer
  writeupas affected products2026-08-17

  Sessions stolen by MacSync Stealer.

• StubMaker RubyGems Campaign Delivers a Windows Infostealer
  writeupas classification.technologies2026-08-16
• Socket: 737 Malicious VPN/Proxy Chrome Extensions Impersonate 66 Brands
  writeupas classification.technologies2026-08-12
• CRPX0 — SCAMMER TURNED RANSOMWARE OPERATOR
  writeupas classification.technologies2026-08-03
• Python OSINT Toolkit for Telegram
  articleas classification.technologies2026-07-31
• Reverse Engineering the Six Stages of MacSync Stealer and RAT
  writeupas classification.technologies2026-07-29
• BBRadar
  toolas classification.technologies2026-07-18
• Socket: 11 Malicious NuGet Tools Pose as Game Cheats
  writeupas classification.technologies2026-07-15
• LoTL Abuse: How to Spot It vs. Normal Admin Activity | Huntress
  articleas tools2026-07-08

  Referenced as an exfiltration destination pointed to by code comments in an LLM-generated script

• Meta Phishers Abuse Business Account Manager Service | Huntress
  writeupas tools2026-07-07

  Used by attackers to receive exfiltrated stolen credentials via a bot channel (@bulondondam / data1mdobot)

• AI Security Briefing
  advisoryas classification.technologies2026-07-05
• macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox
  writeupas classification.technologies2026-06-23
• Inside Kali365, a Device Code Phishing Ecosystem | Huntress
  writeupas classification.technologies2026-06-11
• The Software Supply Chain Malware Landscape: January - May 2026
  articleas classification.technologies2026-06-03
• Open ASM Platform
  repoas classification.technologies2026-05-17
• How EvilTokens Turbocharges Old School Phishing with AI
  articleas tools2026-05-11

  Platform where EvilTokens and other phishing kits were marketed and sold, including customer service, onboarding support, and loyalty discounts for buyers.

• OpenClaw MAESTRO
  writeupas classification.technologies2026-05-06
• ClickFix Removes Your Background but Leaves the Malware
  writeupas affected products2026-04-30

  Entire tdata directory copied wholesale for session takeover

• How Threat Actors Abuse Remote Management Tools | Huntress
  writeupas tools2026-03-11

  Used by threat actors for C2 notifications, exfiltration channel (attempted), and storage of harvested victim data (W-9 forms, SSNs, PII).

• Reflecting on AI in 2025: Faster Attacks, Same Old Tradecraft
  writeupas affected products2026-01-12
• Detecting and countering misuse of AI: September 2026
  articleas classification.technologies