Cybersecurity researchers have recently detected several attacks that are generally using a remote access virus through Telegram communications to steal data from victims and perform malicious activities on the infected devices.
The threat actors are using the Telegram messenger as a C&C server to spread malware to steal confidential information.
According to Checkpoint report, researchers have detected nearly 130 attacks in the past three months. And they say that the hackers are using Telegram to install a new multi-functional Trojan for remote access, “ToxicEye.”
However, the analysts have noted that the main reason for hacker activity is not a vulnerability that is present inside the messenger but the twist and turns of its architecture.
Moreover, the user who is very new to Telegram, those who have never used it can also become victims of such attacks.
The hackers are continuously targeting Telegram, and the attackers have many reasons in their bucket to target Telegram; here they are mentioned below:-
The experts have listed all the exploits that are performed by ToxicEye on the infected machine:-
The very first thing that is done by the threat actors is that they create an account, and along with that the hackers also open a Telegram ‘bot’, or special remote account.
However, with this special account, users can interact by Telegram chat or by adding them to Telegram groups, or simply sending requests directly from the input field by typing the bot’s Telegram username.
The analysts also aserted that the bot is embedded into the ToxicEye RAT configuration file, and later, it was attached and put into an executable file.
When the hacker is done with the installation process of the executable file, the threat actors can hijack the computer through the bot.
There are some points by which one can spot or know the infection, and also keep themselves protected.
The security researchers have urged the Telegram organizations and users to keep a brief knowledge of the latest phishing attacks and be highly suspicious of emails with a username or organization name that are embedded in the subject.
A startling discovery by BeyondTrust researchers has unveiled a critical vulnerability in Microsoft Entra ID…
The Cofense Phishing Defense Center has uncovered a highly strategic phishing campaign that leverages Google…
Cybersecurity researchers from Trustwave’s Threat Intelligence Team have uncovered a large-scale phishing campaign orchestrated by…
Cisco Talos has uncovered a series of malicious threats masquerading as legitimate AI tool installers,…
Pure Crypter, a well-known malware-as-a-service (MaaS) loader, has been recognized as a crucial tool for…
A recent discovery by security researchers at BeyondTrust has revealed a critical, yet by-design, security…