Thousands of Git Repositories Exposed in Widespread Credential Leak Researchers at Intruder uncovered a critical security lapse exposing over 28,000 publicly accessible .git repositories, containing sensitive credentials, financial data, and internal records. The issue stems from misconfigured web servers inadvertently leaving Git directories reachable, allowing automated scanners to retrieve code, historical commits, and embedded secrets even after developers believed they had been removed. The scan, conducted across 3.5 million live hosts, revealed 400+ active AWS access keys, 107 Stripe API keys, 123 OpenAI API keys, 80 Telegram tokens, and 17 GitHub personal access tokens. Some keys remained functional, granting potential access to cloud environments, payment systems, and internal documents. One exposed AWS key provided entry to a storage bucket holding employee records, including attendance logs and disciplinary files, while another leaked transaction histories, revenue data, and partial bank details via a payment service. The risk is amplified by Git’s version history, which preserves secrets across deleted branches and past commits. Attackers increasingly automate credential harvesting, with prior research showing exposed AWS keys discovered within minutes of public disclosure. Intruder’s findings align with recent incidents, such as CISA’s GitHub exposure, where outdated cloud credentials remained exploitable for years. The report highlights that exposed .git directories should be treated as urgent security incidents, not minor misconfigurations. Organizations are advised to revoke all credentials found in repository history, audit cloud and payment logs for misuse, and implement stricter access controls. Developers should adopt pre-commit secret scanning, block rules for sensitive files, and deployment checks to prevent recurrence. Intruder responsibly notified affected parties, leading to repository takedowns and credential rotations in some cases. The incident underscores the broader risk: an exposed Git directory can serve as a searchable archive of organizational access, turning a development oversight into a critical breach vector.

Vanta Stealer: Python-Based Malware Leverages PyArmor Obfuscation for Cross-Platform Data Theft Researchers have identified Vanta Stealer, a sophisticated Python-based information stealer that targets Windows systems, employing layered obfuscation to evade detection and exfiltrate sensitive data. The malware, compiled with Visual Studio 2022 and packed using PyInstaller, embeds a Python runtime and modules into a single executable, complicating reverse engineering efforts. ### Key Features & Attack Chain Vanta Stealer employs PyArmor, a commercial code protection tool, to encrypt its payload, forcing analysts to bypass obfuscation before examining its logic. Once deobfuscated, the malware follows a modular, staged approach: 1. Collection – Dynamically retrieves browser credential extractors at runtime, reducing the need for full binary redistribution. 2. Targeted Theft – Harvests data from Discord, Telegram, Steam, Roblox, Minecraft, Riot/Valorant, Mullvad VPN, and cryptocurrency wallets, along with screenshots, webcam captures, and documents containing seed phrases or private keys. 3. Enrichment – Validates stolen Discord tokens via the Discord API, extracting usernames, emails, phone numbers, Nitro status, payment methods, and server admin privileges to prioritize high-value accounts. 4. Packaging & Exfiltration – Generates a Summary.txt report detailing compromised assets, then compresses all stolen data into a ZIP archive with metadata (victim ID, username, execution mode) before uploading to a hard-coded C2 server via HTTP POST. ### Evasion & Distribution Tactics - PyArmor obfuscation hinders static analysis, requiring specialized tools (e.g., PyArmor Static Unpack) to recover readable Python bytecode. - Modular design allows operators to update components (e.g., browser theft logic) without redistributing the full payload, evading signature-based detection. - Likely distributed via social engineering lures, including trojanized installers, cracked software, game cheats, fake updates, and malvertising, mirroring tactics used by similar stealers like VVS Stealer. ### Impact & Trends Vanta Stealer exemplifies the growing use of Python in malware development, combining commercial obfuscation tools, runtime module retrieval, and enriched victim profiling to maximize stolen data value. Its ability to dynamically adapt harvesting logic and prioritize high-value targets underscores the evolving sophistication of modern infostealers. Defenders are advised to monitor for suspicious PyInstaller executables and obfuscated Python artifacts as part of broader threat detection strategies.

Critical Path-Traversal Flaw in fast-mcp-telegram Exposes Telegram Accounts to Unauthorized Access A severe vulnerability (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) in fast-mcp-telegram a Telegram MCP server bridging accounts to AI assistants and HTTP clients allows attackers to bypass authentication and gain full access to a Telegram session by exploiting a path-traversal flaw in session file resolution. ### Vulnerability Details The flaw affects versions ≤ 0.19.0 of fast-mcp-telegram, where bearer tokens are improperly validated. Instead of treating tokens as opaque identifiers, the server constructs session file paths by directly appending the token to a directory (e.g., `session_dir/{token}.session`). While the code blocks reserved names like telegram, it fails to sanitize path separators (`/`, `\`, `..`), enabling attackers to craft malicious tokens (e.g., `../fast-mcp-telegram/telegram`) that resolve to the default `telegram.session` file. This bypasses the intended high-entropy token requirement, granting unauthorized access to the default Telegram account including message read/write capabilities, MTProto API calls, and exposed tools without requiring a valid token. ### Impact & Exploitation - Authentication Bypass: Attackers can impersonate the default Telegram account by submitting a traversal sequence in the `Authorization: Bearer` header. - Privileged Access: Once authenticated, attackers gain full control over the account’s messages, API functions, and configured tools. - Downstream Risks: Middleware tool prefixing (e.g., account-specific restrictions) fails to mitigate the issue, as the flaw occurs during session selection, not tool enforcement. ### Remediation & Response The vulnerability was reported by David Carliez and patched in version 0.19.1, which enforces stricter token validation. Recommended actions include: - Immediate upgrades to the latest version. - Rotation of default/legacy session files to prevent lingering exposure. - Log audits for suspicious bearer tokens containing traversal sequences. The flaw underscores the risks of improper path handling in authentication systems, where filesystem-dependent logic can undermine security boundaries.

New Telegram Session-Stealing PowerShell Script Discovered on Pastebin Cybersecurity researchers at Flare have identified a malicious PowerShell script hosted on Pastebin, designed to steal Telegram session data from both desktop and web-based clients. The script, titled "Windows Telemetry Update," masquerades as a legitimate Windows system update to deceive users into executing it. Upon execution, the script first gathers host metadata including the victim’s username, computer name, and public IP address before targeting Telegram’s session files in directories like `%APPDATA%\Telegram Desktop` and `%APPDATA%\Telegram Desktop Beta`. These files are compressed into a temporary diag.zip archive and exfiltrated via the Telegram Bot API. Two versions of the script were found on Pastebin under the same account. The initial version (v1) contained a broken multipart upload implementation, preventing successful data exfiltration. The operator later released a corrected version (v2), which properly transmits the stolen data using the `sendDocument` endpoint. The debugging process, visible in the Pastebin post history, offers rare insight into the development of session-stealing tools. The script forcibly terminates the Telegram process to bypass file locks before compressing session data. If the primary exfiltration method fails, a fallback `WebClient UploadFile` ensures the archive reaches the attacker. The script then deletes diag.zip to minimize forensic traces. A separate web-based stealer component, sharing the same bot infrastructure, captures Telegram Web’s `localStorage` session keys, allowing attackers to reconstruct authenticated sessions without passwords or SMS verification. Flare’s analysis suggests the script was still in testing rather than active deployment. However, the functional v2 variant and shared infrastructure with the web-based stealer indicate the capability is now validated and could be scaled for broader use. The lack of obfuscation, persistence, or automated delivery mechanisms further supports this assessment.

AI Agents Vulnerable to Zero-Click Data Exfiltration via Link Previews AI security firm PromptArmor has uncovered a critical vulnerability in AI agents integrated with messaging platforms, enabling zero-click data exfiltration through malicious link previews. Attackers can exploit this flaw by injecting prompts into chat interactions, tricking AI agents into generating URLs containing sensitive data such as API keys which are then automatically fetched by link preview systems. Unlike traditional prompt injection attacks, which require user interaction (e.g., clicking a link), this method leverages automated link previews in apps like Slack, Telegram, and Microsoft Teams to extract data without any user action. Once an AI agent processes a malicious prompt, the compromised URL is fetched by the preview system, exposing the data in the attacker’s logs. Testing by PromptArmor revealed that Microsoft Teams (paired with Copilot Studio) was the most frequently affected platform, followed by combinations like Discord with OpenClaw and Slack with Cursor Slackbot. Some setups, such as Claude in Slack and OpenClaw via WhatsApp, were found to be less vulnerable. The issue stems from how messaging apps handle link previews, with fixes largely dependent on platform developers. PromptArmor recommends that communication apps introduce customizable link preview settings to mitigate risks, particularly in environments where confidentiality is critical. Until then, the vulnerability remains a significant threat to AI-driven workflows.

Sophisticated Telegram Phishing Campaign Exploits Legitimate Authentication Features A new phishing operation is targeting Telegram users worldwide by hijacking the platform’s official authentication mechanisms. Unlike traditional phishing attacks that rely on fake login pages or malware, this campaign integrates directly with Telegram’s API, making it harder to detect. Discovered by cybersecurity firm CYFIRMA, the attack employs two primary methods: - QR Code Login: Victims scan a Telegram-style QR code, triggering a legitimate login request on the attacker’s server. - Manual Login: Victims enter their phone number and, if prompted, their OTP or two-step verification password, which is relayed to Telegram’s official APIs. The critical phase occurs when Telegram’s security protocols send an in-app confirmation prompt to the victim’s device. Attackers use social engineering such as framing the request as a "security check" to trick users into approving the login. Once authorized, the attacker gains full access to the victim’s account without bypassing encryption or exploiting software flaws. The campaign is highly organized, with a centrally managed infrastructure that rapidly deploys new domains while reusing backend logic. Technical analysis reveals Simplified Chinese language settings in the code, suggesting multilingual targeting. Compromised accounts are often repurposed to spread phishing links to the victim’s contacts, amplifying the attack’s reach. This method exploits legitimate platform features, evading traditional security measures. By leveraging MITRE ATT&CK techniques including T1566.002 (Spearphishing Link), T1078 (Valid Accounts), and T1556 (Modify Authentication Process) the attackers bypass detection while maintaining persistence. The campaign underscores a growing trend in cybercrime: the abuse of trusted services to deceive users into granting unauthorized access.

Arsink: Android Malware Exploits Cloud Tools for Large-Scale Data Theft A sophisticated Android remote access trojan (RAT) dubbed Arsink has been uncovered, leveraging free cloud services to steal sensitive data and remotely control infected devices. Security firm Zimperium tracked the malware over several months, identifying 1,216 unique APK files, 317 Firebase command-and-control (C2) servers, and 45,000 victim IP addresses across 143 countries. ### Distribution & Deception Hackers distributed Arsink through Telegram channels, Discord posts, and MediaFire links, disguising it as modified or "pro" versions of popular apps from over 50 brands, including Google, YouTube, WhatsApp, Instagram, TikTok, and Facebook. Once installed, the malware requests excessive permissions, hides its icon, and operates covertly offering no legitimate functionality while harvesting data. ### Four Attack Variants Zimperium identified four primary Arsink variants, each using different cloud-based exfiltration methods: 1. Firebase + Google Apps Script – Small data (e.g., device info) is sent to Firebase Realtime Database, while larger files (photos, audio) are uploaded via Google Apps Script to Google Drive. 2. Telegram Exfiltration – SMS messages, call logs, and device details are transmitted directly to a hacker-controlled Telegram bot. 3. Embedded Dropper – A secondary payload is hidden within the app, extracted and renamed (e.g., Ai_App.zip to App.apk) without requiring internet downloads, evading detection. 4. Hybrid Cloud Abuse – Combines Firebase, Google Drive, and Telegram for data theft and command execution. ### Data Theft & Remote Control Arsink captures a full device snapshot, including: - Device details (model, battery, location, Google account emails) - SMS messages (including one-time passcodes) - Call logs & contacts - Microphone recordings (stored in cloud storage) - Photos & files (listed for potential upload) Attackers can remotely: - Toggle the flashlight, vibrate the phone, or play sounds - Change wallpaper, display messages, or speak text via text-to-speech - Initiate calls, manage files (upload, delete, wipe external storage) - Hide the app icon and maintain persistence via fake foreground notifications ### Global Impact & Victim Distribution The malware has infected users across the Middle East, Asia, Africa, Europe, and the Americas, with the highest concentrations in: - Egypt (13,000 infections) - Indonesia (7,000) - Iraq & Yemen (3,000 each) - Türkiye (2,000) - Pakistan & India (2,500 each) - Bangladesh (1,600) - Algeria & Morocco (1,000 each) India’s high infection rate correlates with frequent Telegram-based APK distribution. ### Mitigation & Response Zimperium collaborated with Google to dismantle malicious Firebase endpoints, Apps Scripts, and accounts. Google Play Protect now blocks known Arsink samples outside the Play Store. However, attackers rapidly adapt, making behavior-based detection critical for enterprises, particularly as the malware targets work-related credentials via SMS interception. Arsink’s use of legitimate cloud services for C2 operations highlights the growing challenge of detecting malware that blends into normal traffic.

Massive Telegram Data Leak Exposes 200M+ User Records on Dark Web Forum On January 24, attackers posted a dataset containing over 200 million Telegram user records on a popular data leak forum, exposing sensitive information including phone numbers, email addresses, and user IDs. The leaked data spans three databases "Telegram user data," "Source platform," and "Telegram" totaling 44GB when uncompressed. Researchers from Cybernews analyzed a sample of the data and found 66 million phone numbers, 10 million user records, and 60 million likely Telegram-related entries. While some details may have been scraped from public profiles, the inclusion of non-public data like emails suggests the leak may also incorporate older breaches or unauthorized access. The dataset’s scale raises concerns about large-scale phishing campaigns, as attackers could exploit the exposed contact information to target users globally. However, the exact origin of the data remains unclear researchers have not confirmed whether it stems from a new breach, aggregated scrapes, or a combination of both. Duplicates in the dataset could also reduce its actual impact. The post on the data leak forum has remained active since its publication, with daily user engagement indicating ongoing interest among cybercriminals. Telegram has yet to respond to requests for comment. Separately, the incident follows a December 2023 report by cybersecurity firm NVISO, which revealed an 8.7 billion-record leak from Chinese databases, highlighting a broader trend of massive data exposures in recent months.

Telegram Proxy Link Vulnerability Exposes User IP Addresses Security researchers have uncovered a critical flaw in Telegram’s proxy link handling that can inadvertently reveal users’ real IP addresses. The vulnerability arises when users interact with Telegram usernames or specific proxy-related links, undermining the anonymity these proxies are designed to provide. Proxy links are intended to mask IP addresses, but the discovered flaw allows attackers to extract a user’s actual IP through seemingly routine actions such as clicking a username or engaging with certain links. This poses a significant privacy risk, enabling malicious actors to track user activity or compromise personal data. In response, Telegram has announced plans to implement enhanced security measures, including explicit warnings for users interacting with proxy links. These alerts will notify users of potential IP exposure risks, while broader initiatives such as user education campaigns and improved proxy link management aim to strengthen privacy protections. The platform has reaffirmed its commitment to security, emphasizing ongoing efforts to address emerging threats and reinforce user trust. The updates are expected to roll out as part of Telegram’s broader strategy to mitigate risks and enhance privacy safeguards.

Chinese Users Targeted by Malware Campaigns via Spoofed Downloads and SEO Poisoning Cybersecurity researchers from Fortinet FortiGuard Labs and Zscaler ThreatLabz have uncovered malware campaigns targeting Chinese users seeking popular software downloads. Attackers are leveraging typosquatted domains, SEO poisoning, and GitHub Pages to distribute remote access trojans (RATs), including new and sophisticated variants. ### Key Campaigns and Tactics 1. SEO Poisoning & Trojanized Installers - Threat actors created fake download pages for widely used applications, including Google Chrome, Signal, Telegram, WhatsApp, WPS Office, and DeepL Translate. - Using SEO manipulation, they tricked users into visiting malicious sites, where trojanized installers delivered HiddenGh0st and Winos both variants of the notorious Gh0st RAT. 2. kkRAT: A New and Evasive Threat - Zscaler identified kkRAT, a previously unknown trojan with Gh0st RAT and Big Bad Wolf code similarities, active since May 2024. - Features include: - Clipboard hijacking to replace cryptocurrency wallet addresses. - Remote monitoring via tools like Sunlogin and GotoHTTP. - Antivirus evasion by disabling security software, including 360 Internet Security, 360 Total Security, and HeroBravo System Diagnostics. - The malware uses encrypted network communication to avoid detection. 3. GitHub Pages Exploited for Phishing - Unlike the typosquatted domains in Fortinet’s findings, the kkRAT campaign abused GitHub Pages to host phishing sites, exploiting the platform’s trusted reputation. - The malicious GitHub account has since been terminated. ### Impact These campaigns highlight a growing trend of social engineering and supply-chain deception, where attackers exploit trust in legitimate platforms and software to deploy malware. The use of advanced RATs with antivirus evasion and cryptocurrency theft capabilities underscores the evolving sophistication of cyber threats targeting Chinese users.

Telegram’s Privacy Reputation Under Scrutiny After Major Leaks and Vulnerabilities Telegram, long marketed as a privacy-focused alternative to mainstream messaging apps, has faced growing scrutiny after a series of high-profile data exposures and security flaws revealed significant risks to users. Recent incidents including a massive data leak, a critical IP disclosure vulnerability, and account compromises have challenged the platform’s reputation for security. ### The 200 Million Record Leak: A Crisis of Trust In January 2025, a 44GB dataset containing over 200 million Telegram user records surfaced on a data leak forum. The exposed data included email addresses, phone numbers, and usernames information not publicly accessible under normal circumstances. While Telegram dismissed the leak as the result of contact-importing features, researchers confirmed the presence of non-public data, raising concerns about potential phishing, SIM-swapping, and credential-stuffing attacks. The incident highlighted a key debate: whether the leak stemmed from a new breach or an aggregation of previously scraped data. Regardless of its origin, the exposure underscored the risks of large-scale data leaks, even when the platform itself isn’t directly compromised. ### The One-Click IP Leak: A Silent Threat In January 2026, security researchers disclosed a critical vulnerability in Telegram’s mobile apps that allowed attackers to expose users’ real IP addresses with a single click. The flaw, dubbed the "one-click IP leak," exploited Telegram’s MTProxy system a feature designed to bypass censorship. When users clicked a disguised proxy link (e.g., appearing as a username), the app automatically tested the connection, revealing their IP address before any warning appeared. The vulnerability affected both Android and iOS users, enabling attackers to geolocate victims, identify ISPs, and potentially compromise operational security for journalists, activists, and corporate users. While Telegram acknowledged the issue and promised a warning prompt, the fix did not address the underlying architectural flaw. ### The Handala Leak: Misunderstood Account Compromises A separate incident involving the hacktivist group Handala further illustrated Telegram’s security challenges. The group claimed to have compromised iPhone devices of Israeli targets, but forensic analysis revealed the breaches were due to Telegram account takeovers not device-level hacks. This distinction highlighted a common misconception: Telegram’s encryption does not protect against account hijacking via SIM swapping, session hijacking, or social engineering. ### Why Telegram Is a Prime Target With over 900 million users including activists, journalists, businesses, and government officials Telegram has become a high-value target for cybercriminals. Its vast user base, combined with a 2024 policy shift allowing government access to user data under legal requests, has expanded its threat surface. Cybersecurity firms like NVISO have even recommended blocking Telegram’s API for businesses without a critical need, citing growing risks. ### How Telegram Data Ends Up in Leak Forums Leaked Telegram data often circulates through underground forums, where threat actors distribute datasets labeled as "Telegram user databases" or "scraped contact dumps." Some cybercrime groups even operate Telegram channels to share stolen credentials, creating a feedback loop where the platform’s own infrastructure aids in the spread of compromised data. ### The Broader Implications These incidents reveal a critical gap between Telegram’s privacy branding and the realities of securing a massive user base. While no platform is immune to leaks, the combination of mass data exposures, architectural vulnerabilities, and account compromises suggests that users must take proactive steps such as enabling two-factor authentication and scrutinizing links to mitigate risks. As messaging platforms remain central to digital communication, the frequency and sophistication of Telegram-related leaks serve as a reminder that privacy promises are only as strong as the security measures behind them.

A resurgence of the CVE-2024-7014 vulnerability termed 'Evilloader,' exploiting Telegram's Android client through a revised tactic involving disguised .htm files, led to unauthorized JavaScript execution. The attackers leveraged Telegram's multimedia framework and manipulated metadata headers to distribute the malicious files. Victims, deceived into playing a pseudo-video file, inadvertently trigger JavaScript execution in their browsers when redirected by a content:// URI scheme. This exploit, primarily targeting unpatched versions of Telegram (≤10.14.4), facilitated data exfiltration and malware activities such as phishing and banking Trojans. Telegram's delayed response in enforcing robust file validation has instigated significant risks to user data integrity and privacy.