Skip to content

MALICIOUS (1) campaign cataloged at 2026-08-11(2).

  1. The campaign has clearly malicious intent, like infostealers.
  2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2026-08-telebot-pro

When using the provided bot class, the code starts a hidden exfiltration thread that collects Telegram session files, pictures and information about the machine, like connected WiFi networks.

Abuse categories

action-hidden-in-lib-usage

The malicious action is hidden in the code and starts when user interacts with it (e.g. during class initialization or by exfiltrating given credentials).

files_exfiltration

Campaign uses files_exfiltration.

target:telegram

The package is designed to target Telegram users or the Telegram platform.

uses-telegram-bot

Telegram Bot is used for malicious purposes

Packages in the campaign

campaign:2026-08-telebot-pro