New Golang-Based Backdoor Uses Telegram Bot API for Evasive C2 Operations

Cybersecurity researchers have shed light on a new Golang-based backdoor that uses Telegram as a mechanism for command-and-control C2 communications. Netskope Threat Labs, which detailed the functions of the malware, described it as possibly of Russian origin. "The malware is compiled in Golang a...

Malicious code in telegram-bot-hoster3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a657b92399440588fd143dbe4c319d27882350d825a29877b96676add635391e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1443 Malicious code in telegram-bot-hoster3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a657b92399440588fd143dbe4c319d27882350d825a29877b96676add635391e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in telegram-bot-hoster2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f0cd2b5b45da2e84d95f63a130c4c69abcf83af2365c6a45ab3a60b6a61fc41 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in telegram-bot-hoster (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3b1f6f7d44822f546914ae3155fe660229e8ccb900d78e88fe8dfa32aa1ae90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in telegram-bot-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bfce13be8a817c4f8165b600702f49df73736a44741857d560aab26bfa00162 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1442 Malicious code in telegram-bot-hoster2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f0cd2b5b45da2e84d95f63a130c4c69abcf83af2365c6a45ab3a60b6a61fc41 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1441 Malicious code in telegram-bot-hoster (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3b1f6f7d44822f546914ae3155fe660229e8ccb900d78e88fe8dfa32aa1ae90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1440 Malicious code in telegram-bot-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bfce13be8a817c4f8165b600702f49df73736a44741857d560aab26bfa00162 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in node-tg-bot-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa25c03f22731cf537fcef307f4a17c8cde7f9e55ec3fbd4e39168cb337ceccd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in updateuuid4 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2c45f904631a26aae94cafeeac5ea0f7efe0fc5d4f46dea48da17dcb766111d5 The package, with an innocent looking name, has as the only functionality reporting to a Telegram channel given username and password. The functionality is in...

MAL-2025-191917 Malicious code in updateuuid4 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2c45f904631a26aae94cafeeac5ea0f7efe0fc5d4f46dea48da17dcb766111d5 The package, with an innocent looking name, has as the only functionality reporting to a Telegram channel given username and password. The functionality is in...

CVE-2024-9821

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'stmwpcftogetsettings' AJAX action in all versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with...

CVE-2024-9627

The TeploBot - Telegram Bot for WP plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'serviceprocess' function in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to view the Telegram Bot...

MAL-2025-627 Malicious code in node-telegram-bot-sdk (npm)

This package adds the attacker's public SSH key to the user's authorizedkeys file, creating a backdoor. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac040b96e06268d2909a10c620df0339df7c2f6cef468c8c0e3cca3ce347c8f Any computer that has this package installed or...

Malicious code in node-telegram-bot-sdk (npm)

This package adds the attacker's public SSH key to the user's authorizedkeys file, creating a backdoor. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac040b96e06268d2909a10c620df0339df7c2f6cef468c8c0e3cca3ce347c8f Any computer that has this package installed or...

No need to RSVP: a closer look at the Tria stealer campaign

Introduction Since mid-2024, we've observed a malicious Android campaign leveraging wedding invitations as a lure to social-engineer victims into installing a malicious Android app APK, which we have named "Tria Stealer" after unique strings found in campaign samples. The primary targets of the...

CVE-2024-38789

Cross-Site Request Forgery CSRF vulnerability in Marco Milesi Telegram Bot & Channel telegram-bot allows Cross Site Request Forgery.This issue affects Telegram Bot & Channel: from n/a through = 3.8.2...

CVE-2024-38789 WordPress Telegram Bot & Channel plugin <= 3.8.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Marco Milesi Telegram Bot & Channel allows Cross Site Request Forgery.This issue affects Telegram Bot & Channel: from n/a through 3.8.2...

CVE-2024-38789

CVE-2024-38789 corresponds to a CSRF vulnerability in the WordPress Telegram Bot & Channel plugin, affecting versions n/a through 3.8.2. The vulnerability allows unauthorized actions via CSRF; exploitation details are not provided in the documents. A remediation is mentioned: update to a version ...