Telegram Desktop

HEAVYGRAM Spyware Uses Telegram Bots for Command and Control Against Iranian Targets

Researchers at Group-IB have published a detailed analysis of HEAVYGRAM, a spyware family that abuses the Telegram messaging platform as its command-and-control infrastructure. The malware family was first observed in the second half of 2023 and has since been linked with moderate confidence to the Handala Hack group. Instead of operating dedicated servers, the operators rely on Telegram bots, accounts, and groups to register infected hosts, receive commands, exfiltrate stolen data, and deliver additional payloads. Once active, HEAVYGRAM captures screenshots, records audio, harvests cached files, and steals data from Telegram Desktop installed on the victim machine. The campaign primarily targets Iranian journalists, dissidents, and individuals opposed to the Iranian government. Infection vectors include malicious files distributed via messengers, disguised as legitimate applications such as Pictory, KeePass, or Telegram-related tools, sometimes delivered as HTML applications or scripts.

Stored XSS in Telegram Desktop Allows Silent Data Exfiltration via Chat Export

Researchers at ExPatch Vulnerability Research discovered a stored XSS vulnerability in Telegram Desktop that could be triggered when users exported chat history to HTML. The flaw resided in export_output_html.cpp where button text from inline keyboards was not passed through the SerializeString function, allowing arbitrary HTML and JavaScript to execute upon opening the exported file. Attackers could deliver the payload through a bot that never joined the target group, relying on message forwarding to reach victims. Once executed, the script exfiltrated all visible messages, chat metadata, and file paths to an attacker-controlled server while optionally replacing the page with a phishing form. Telegram issued a silent fix in Beta v6.9.4 and Stable v7.0.1 without publishing an advisory or assigning a CVE. The researchers refused the offered bounty and published the details after the patch to inform users about risks from previously exported files.

Telegram Desktop HTML Export Flaw Allowed Stealthy JavaScript Injection into Chat History

Researchers at ExPatch identified a vulnerability in Telegram Desktop that enabled attackers to embed malicious JavaScript into exported HTML chat histories without user detection. The flaw stemmed from insufficient sanitization of button captions added by bots, allowing hidden scripts to execute when the HTML file was opened in a browser. Malicious messages could be forwarded into chats and remain dormant until export, potentially exfiltrating messages, sender names, and timestamps to attacker servers. The issue affected versions 4.15.1 through 6.9.3, with fixes released in beta 6.9.4 and stable version 7.0.1 on July 14. No in-the-wild exploitation was observed, though the attack required specific conditions including an unpatched export and JavaScript-enabled browser. Users are advised to re-export chats after updating or open old files with JavaScript disabled.

Telegram Desktop Bug Deletes Up to 800 GB of User Data on Windows Due to Spellcheck Library Error

A critical configuration flaw in Telegram Desktop for Windows caused the application to recursively delete the entire contents of the C:\custom directory, resulting in the loss of approximately 800 GB of user data including programs, projects, and personal files. The issue originated in the lib_spellcheck library introduced in version 7.1.0, where an empty working directory path was concatenated with /custom and resolved by Qt into an absolute system path. Instead of locating a dictionary file, the code invoked removeRecursively() on the discovered directory, systematically erasing all accessible files while leaving folder structures intact. The bug affected only Windows builds with the built-in spellchecker enabled and remained in distribution for roughly 66 hours across versions 7.1.0 and 7.1.1. Researchers confirmed the behavior using Process Monitor logs and reported it via ticket #31170, prompting developers to add path validation before the function call and disable dictionary operations on empty paths. The corrected code was released in Telegram Desktop 7.1.2, and users running the vulnerable versions are advised to update immediately. No impact was observed on Linux or macOS platforms.

Telegram Desktop Bug Deletes 800 GB of User Data Due to Spelling Checker Path Error

A Telegram Desktop update introduced a critical flaw that caused the application to recursively delete user folders containing up to 800 GB of data on Windows systems. The root cause traced back to an incorrect path construction for the custom dictionary file used by the lib_spellcheck library when Windows native spell checking was enabled. Due to a misplaced return statement in the code, the working directory path remained empty, leading Qt to interpret the path as the root-level C:\custom folder. The application then invoked QDir::removeRecursively on this directory, removing all accessible files while skipping locked ones. The bug affected releases 7.1.0 and 7.1.1 for approximately 66 hours before being fixed in version 7.1.2. Researchers used Process Monitor to confirm Telegram.exe was directly responsible for the deletion attempts. The incident highlights risks of combining recursive deletion functions with unvalidated path inputs in widely used applications.

Telegram Desktop Adds WEB Proxy to Hide MTProxy Traffic Inside HTTPS and WebSocket Connections

Telegram Desktop has received an initial implementation of a new WEB proxy designed to conceal messenger connections within ordinary HTTPS and WebSocket traffic. The feature makes user activity appear as simple website browsing to network providers while MTProxy continues to operate underneath. Developers inserted more than 3,000 lines of code, including a dedicated WEB-proxy transport, domain configuration options, and interface elements such as “Open browser” and “Waiting for browser.” The mechanism works by opening an embedded web page that establishes a secure WebSocket link to a domain resembling a regular site. Multiple MTProxy connections are multiplexed into a single stream and sent through this channel. On the server side an intermediate node demultiplexes the stream and forwards the individual connections to a standard MTProxy instance without decrypting message content.