45
30
45
Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports
Telegram Desktop HTML export XSS (CVSS 8.2) let bot messages exfiltrate exported chats; fixed in 7.0.1 but old exports stay vulnerable.
ExPatch researchers found that Telegram Desktop versions 4.15.1 (March 2024) through 6.9.3 wrote bot inline-keyboard button text into HTML chat exports without escaping, allowing a bot to plant invisible JavaScript. When a user opened the export in a browser, the script could exfiltrate every message in that 1,000-message file, rewrite the displayed content, or fake a verification form. The flaw (rated CVSS 3.1 8.2) was fixed by commit 8457d13a in 6.9.4 beta (July 3, 2026) and 7.0.1 stable (July 14, 2026), but pre-fix exports remain dangerous since updating the app does not fix old files. No CVE identifier or Telegram security advisory exists, and no exploitation in the wild is claimed.
52
30
30
30
30
30
Telegram Desktop Flaw Could Turn Old Chat Exports Into Data Theft Traps
ExPatch disclosed stored XSS in Telegram Desktop HTML export letting bot messages steal chat data when exports open in browsers.
ExPatch researchers Denis and Aleksander Rostilov found a stored XSS flaw (CVSS 8.2) where bot inline keyboard button text was written unescaped into HTML chat exports, executing attacker JavaScript in browsers. The payload can persist in chat history for months, exfiltrate messages, metadata, and local file paths, and rewrite the page, spreading via forwarded messages without bot membership. Telegram fixed it by applying SerializeString(), first stable fixed release 7.0.1 shipped July 14, 2026, but HTML exports created with vulnerable versions remain dangerous.
45
45
30
30
45
30
30
30
30
45
30
30
30
45
30
30
30
New Python-Based Payload MechaFlounder Used by Chafer
Unit 42 identified MechaFlounder, a new Python backdoor used by the Chafer group to target a Turkish government entity via HTTP-based C2.
Unit 42 reports that in November 2018 the Chafer group targeted a Turkish government entity, reusing the win10-update[.]com infrastructure reported earlier in 2018 by ClearSky. The new secondary payload, tracked as MechaFlounder, is Python compiled with PyInstaller and acts as a backdoor supporting file upload/download and command execution. It beacons over HTTP using anomalous GET requests containing the username and hostname, suggesting a custom C2 server rather than a standard web server. Code overlap with OilRig's Clayside VBScript was noted, but Chafer and OilRig remain tracked as separate groups.
44
45
30
45
DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt
Microsoft reports DeadLock ransomware using Polygon smart contracts and Session messaging for extortion infrastructure, claiming 96 victims across Europe and the U.S.
Microsoft Threat Intelligence reports the DeadLock ransomware operation uses the Session messaging network and Polygon blockchain smart contracts to host victim chat, proxy server addresses, and its data leak blog, making takedowns harder. First detected in July 2025, the group has claimed 96 victims, mostly in Italy, Spain, Poland, Türkiye, and the U.S., with deployments by affiliates of Lynx and INC ransomware. The encryptor uses Curve25519 with XChaCha20, drops an interactive HTML recovery chat application, geofences CIS-linked countries, and clears logs and shadow copies to evade forensics.
62
45
45
30
30
30
30
30
30
45