TWEAKOS Malware Turns Telegram Into a Stealer, C2 Platform and Stolen Account Marketplace

TWEAKOS steals messaging accounts and turns them into items for sale. The operation pairs a Windows stealer with a Telegram bot for managing victims and selling stolen access.

The threat surfaced after its source code appeared on Pastebin. Researchers recovered two related Python components, but do not know how the stealer reaches victims or how many people were affected. Running it can expose Discord accounts and create a reusable Telegram login session.

Analysts at Flare linked the components through their shared bot credentials and operator accounts. The same Telegram bot supports theft, operator access and account sales.

Unlike other malware targeting both messaging platforms, this operation also builds a storefront around the stolen access. A stolen session can let someone act as the account owner, while a valid Discord token gives an intruder account access.

Flare said in a report shared with Cyber Security News (CSN) that the researchers found both capabilities in the code, but did not confirm that the exposed bot remained reachable.

TWEAKOS Malware Turns Telegram Into a Stealer

On an infected Windows system, the stealer arranges to run again when the user signs in. A packaged version copies itself into the user’s Startup folder, while a script version adds a user-level startup entry.

Neither method needs administrator privileges, making the program easier to keep running after a restart. The code then looks for Discord authentication tokens in local storage used by Discord, its test build and Chrome’s default profile.

It checks possible tokens with Discord and sends valid ones to the operators through Telegram. The Chrome search is narrow: it does not read stored browser passwords, cookies or the browser’s encryption keys.

That differs from the wider browser theft described in earlier reporting on Discord stealers. TWEAKOS focuses on tokens it can confirm still work, then sends the account identity alongside them.

The code also attempts a separate Telegram takeover, which needs direct interaction from the person running it. For that takeover, the program asks for a phone number and login code, then requests a cloud password if the account requires one.

It uses those answers to sign in through Telethon and make a fresh session. If the session file exists, it sends a copy to two operator accounts, allowing them to reuse that login.

The code may generate a new password string when none exists, but it never actually changes the account password. That distinction matters: the risk is an authorized session in someone else’s hands, not proof that the victim’s password was reset. The report identifies no particular delivery lure.

Inside the Telegram Storefront

A second Python component runs the Telegram bot, keeping records of victims, buyers, products and completed orders in a local database.

Its shop offers Telegram and Discord accounts, issues invoices in Telegram Stars and sends purchased credentials to buyers after payment. Prices fall by 5% per day, up to a 70% discount, with a minimum of one Star.

That model echoes previous reporting on Telegram marketplaces, although TWEAKOS connects the shop directly to its stealing operation. Operators can also view victim records, send messages and trigger a script that displays a repeating warning on a victim’s screen.

Another option references a supposed security update payload, but researchers did not recover the file and could not verify what it does.

The link between theft and recordkeeping is imperfect. Stolen material goes straight to operator chats, while the bot’s database handler processes incoming messages from nonoperators.

Its Discord check also expects different capitalization from the stealer’s output. As a result, database records may miss compromised accounts even when operators received their details.

For investigations, Flare recommends checking operator chat records rather than relying on the database alone. Defenders should watch for unusual startup entries, access to Discord token storage followed by validation requests, and Telegram traffic after new session files appear.

Affected users should invalidate Telegram sessions, revoke exposed Discord tokens and enable multifactor authentication; unexpected requests for login codes or cloud passwords deserve immediate suspicion.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Domain	api.telegram.org	Telegram Bot API host used for operator-bound messages and session-file transfers; legitimate shared infrastructure.
URL	discord[.]com/api/v9/users/@me	Discord API endpoint used to check whether harvested tokens work.
URL	https://discord[.]gg/tweakos	Invite shown in the coercive screen message; researchers found it invalid during analysis.
File name	SystemHelper.exe	Persistence file used by the packaged Windows build.
Registry key and value	HKCU\Software\Microsoft\Windows\CurrentVersion\Run → SystemHelper	User-level persistence used by the script build.
File path	%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\	Startup folder where the packaged build places its persistence file.
File name pattern	{phone}.session	Telegram session file the stealer checks for and sends to operators.
File name pattern	session_{uid}.session	Name used when the bot saves an inbound session file.
File name pattern	blocker_{uid}.vbs	Per-victim script that displays the coercive warning.
File name	WindowsSecurityChecker.exe	Referenced follow-on payload; researchers did not recover the binary.
File name	tweakos_data.db	Bot database used for victim, product, buyer and order records.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC