🧰 Telegram Desktop

The items that name it 4

• MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work
  writeup2026-10-05

  Session data (%APPDATA%\Telegram Desktop\tdata) copied by movinlike

• StubMaker RubyGems Campaign Delivers a Windows Infostealer
  writeup2026-08-16

  tdata (standard and UWP install locations) targeted for exfiltration

• Reverse Engineering the Six Stages of MacSync Stealer and RAT
  writeup2026-07-29

  Entire tdata/ session directory stolen

• jscrambler npm Package Compromised in Supply Chain Attack
  writeup2026-07-11

  tdata, key_datas targeted