Telegram Desktop: one-click account takeover via IPC injection
Telegram Desktop through 7.2.8 let a clicked link steal local login files.
66
Product
Telegram Desktop
- Mentions · 7d0
- Mentions · 30d3
- All mentions4
- First seenSep 17, 2026
- Last mentioned23d ago
Timeline
4 articles · newest firstPoC Released for Telegram Desktop Flaw Enabling One-Click File Account Takeover
Public PoC shows Telegram Desktop before 7.2.9 can leak local files and sessions via a crafted link.
64
Malicious npm Packages Steal Browser Passwords, Discord Tokens and Crypto Wallets.
The MALFEX npm campaign ships Overlord RAT and movinlike to steal browser passwords, Discord tokens, and crypto wallets.
71
Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM
Group-IB links new HEAVYGRAM and CRUDEEXCLUDE malware to Iran-aligned Handala Hack (MOIS/Void Manticore), which spies on Iranian dissidents using Defender exclusions and Telegram C2.
68
Related CVEs
by mentions- CVE-2026-107181<1%8.6IPC record injection in Telegram Desktop enables account takeover
Appears with
- Telegramvendor · 3
- Group-IBorganization · 1
- Void Manticorethreat actor · 1
- Handala Hackthreat actor · 1
- KeePassproduct · 1
- Ministry of Intelligence and Security (MOIS)organization · 1
- Microsoft Defenderproduct · 1
- MetaMaskproduct · 1
- FBIorganization · 1
- MALFEXthreat actor · 1
- US Department of Justiceorganization · 1
- WhatsAppproduct · 1
- Overlord RATmalware · 1
- Discordproduct · 1
- Phantomproduct · 1
- Pictoryproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.