🧰 Telegram Bot API

The items that name it 4

• Earliest Known PolinRider Malware Found in 2025 npm Packages
  writeup2026-10-30It is written here as Telegram Bot API (sendDocument).

  Fallback exfiltration channel for archives under 50 MB; bot @file_1018_bot, ID 7870147428, chat ID -4697384025

• Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
  writeup2026-10-07

  Abused to exfiltrate victim fingerprinting data (IP, geolocation, browser, OS, download activity) to attacker-controlled chat

• HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack
  writeup2026-09-17

  Abused by HEAVYGRAM for command-and-control, check-ins, file transfer, and exfiltration.

• macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox
  writeup2026-06-23

  Command-and-control channel via getUpdates polling loop; data exfiltration via multipart attach:// file uploads