TWEAKOS Malware Turns Telegram Into a Stealer, C2 Platform and Stolen Account Marketplace
TWEAKOS steals Discord tokens and Telegram sessions, then sells that access through a Telegram bot.
Flare analyzed TWEAKOS after its source appeared on Pastebin, recovering two Python components tied together by shared Telegram bot credentials. On Windows it persists via the Startup folder or a user-level Run key without administrator rights, validates Discord tokens from local storage, and can build a reusable Telegram session after prompting for a phone number, login code, and optional cloud password. A second component runs a Telegram shop that sells stolen Discord and Telegram accounts for Telegram Stars, with prices falling 5 percent per day. Researchers did not confirm the delivery method, victim count, or that the exposed bot remained reachable, and they did not recover a referenced follow-on binary.
- Source appeared on Pastebin; Flare linked two Python components.
- Persists through the Startup folder or an HKCU Run key without admin rights.
- Harvests working Discord tokens and reusable Telegram session files.
- A Telegram bot sells stolen accounts for Telegram Stars.
- Victim count and whether the bot stayed online were not confirmed.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | discord.gg | nt used to check whether harvested tokens work. URL https://discord[.]gg/tweakos Invite shown in the coercive screen message; rese |
From the original article
4 min read at cybersecuritynews.com
TWEAKOS steals messaging accounts and turns them into items for sale. The operation pairs a Windows stealer with a Telegram bot for managing victims and selling stolen access. The threat surfaced after its source code appeared on Pastebin.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.