Topic: Crypto Wallet Hacking through Telegram (Read 966 times)

These Hackers are very very Cunning and they stole people wallets balance without knowing them..I have heard that many have lost almost 10k.solars.plus volume and that's insane..

I am a user of telegram but not really an active one.
But such warning is really good to avoid possible problem in the future.
I believe a lot of telegram users as well as crypto users are not aware of this feature.
A simple turning off the Auto-Download Media may save your funds from those fraudulent activities.
Scammers will always try and try to get into the vulnerabilities of your computer, so no wonder they are resorting to this route.

Dont know if it could ran off automatically even if the app wasnt been launched.
This is why im not really that installing but i have searched out that you could
do disable that automedia download which i could say that it is really that safety to turn it off.

Turn Off Automatic Download of Specific Media on Telegram

Dont know if this one is relevant but not really that something bad to test it out.

Unfortunately, these things are very common, but for the first time I hear that they are also on Telegram. It is necessary to disable the automatic download feature, whether in Telegram or others, this is very dangerous.
But I did not know what kind of wallets were targeted by the virus exactly, there are many versions of Telegram on Mac, Windows, Android and iPhone, I am using the version of Telegram for Windows desktop and I have an Electrum wallet installed on the Windows system, so I do not know if this virus can target this wallet?

Good information OP, thanks for letting us know.

I would also like to add (for those who use Telegram both on cellphone and on PC), I believe that turning off the auto-download on the phone does not prevent this feature to continue on PC and other clients. Be aware of this, because this could mean that the malware could end up being on the Downloads folder of your PC if you are not careful enough. 

Thanks for reporting, I use telegram a lot and I've always kept the automatic media download option disabled.  I can't tell you how they can hack you but lately there are too many scams on the platform, be careful and immediately block anyone who contacts you privately.

Ohh I recently checked that auto media download is enabled on my side too, The OPs wonder how this virus works well. I think this is pretty easy for the already existing file in the device to manipulate personal data. Once this virus installs itself onto your device then you can do anything except for particular scenarios. Virus files duplicate and hide in a proper way then slowly poison your device life line which is (Firewalls / Protection layers and crack your data encryptions).

don't use tg which is best safe

Such experiences teach us to be more cautious next time, while at the same time not trusting anyone on the internet, despite what platform it is. I'm still dumbfounded on how I actually proceeded and typed my private key, how could I be so foolish? I was tired and sleepy, however, I'm still trying to figure out what I was thinking. Fortunately for me, adrenaline rushed through my veins the moment I inserted the private key, realizing that it was a shady and fishy job.

I have always thought that having a different device for you wallet authentications is always best this way we can keep all of our login details away from the our other social media devices. I however understand that it is really difficult to get away from all this scammers trying everything possible to get access to crypto wallets.

That's first thing I do on emails/messengers although reason is to save data  , glad it saves me from this too

Really bad how these hackers keep on coming up with new tricks on how they can go about scamming people. I always make sure to avoid anything that will lead into having problem with any of these scammers online. Always being careful with social media and the type of information I leave online, because if you are not careful on how you’re leaving information online that’s how they would be able to get you. So, it’s very important that we are aware of what we are doing online and know the things that we have to avoid.

Still an experience that will make you the others aware of these scammers and hackers.

There's no need for anyone to input their private keys to such websites if you're holding it in your wallet. It's like you folks being hypnotized online that made you do it.

But with the trick of making their website look legit, that's really one factor that makes people fall for it.

So when you click on a link sent by someone, you are at risk then?  What about things like discord?  Such as imagine you want to join a discord group and someone gives you the link to the group?  Now assuming when you click on it and its the actual group... is it possible you get hacked just for clicking that link because even though it gets you to the group, it still gives malware?

It would be very difficult for anyone to be able to hack your phone or cryptocurrency wallet account through any of these social media platforms, which are Instagram, Facebook, WhatsApp and the rest of them because of how they are built, they are not like Telegram.

Telegram is a totally different app and the way it is built is totally different and it has way too much of allowance for the platform to be used for a lot of things, which kind of allows hackers the opportunity to do almost whatever they want to do with the platform. It’s up to us to be cautious of the apps we are using.

Participants in such cryptocurrency forums are primarily the target of such hacker attacks, because if we use such forums and participate in bounty campaigns that are located in them, then we have cryptocurrency wallets on our devices. If earlier hackers hunted for various information, then during the period of growth of cryptocurrency, they also got a good material incentive for their activities. Therefore, we need to be especially careful with our privacy.

Facebook isn't the website you'll get your cryptocurrency wallet breached, at least such scams don't happen that regularly, compared to Telegram and Discord. Yes, Facebook (I don't use Instagram) is filled with spam, fake contests or fan pages, while there are quite a few incidents of viruses spreading through Messenger, due to some idiots opening links "Is that you on the video, www.randomviruslink.com", but I highly doubt that such attempts are directed towards crypto scamming.

Less incidents on fb and ig? But, how come when facebook and instagram are two of the most famous social media platforms today? Hackers go on a place where its crowded because its going to be easy for them to get a victim. Telegram is also a famous messaging platform and crypto people are using this the most, no wonder why this was invaded by the crypto hackers and not to mention that the amount of spam on this messaging app is too much but that can be fixed.

You can also follow what is posted by the op and you will have a less fear of using telegram. Having a spare device is helpful and you must separate your main device where you store you crypto wallets and other important stuffs.

That's the main reason I don't join groups anymore, Discord, Telegram, whatever it is, except it's an emergency or need specific assistance, which is rare. Anyway, the internet is full of scammers, so it's not surprising that they also appear in cryptocurrency groups, however, they seem to be more common in groups regarding tokens and staking platforms (Beefy, Supra Finance etc.).

You need to be careful and very attentive, because scammers are constantly coming up with new ways of deception. In the telegram settings, you need to disable the automatic download and installation of programs, because in this way you can install a malicious program that will give scammers access to your wallets. Never be in a hurry, always check and think a few times.

Had a conversation a few months ago with an administrator from a Discord group, it was the one that I almost got scammed on. He told me that it's a common occurrence, a daily thing, even in their group, and quite a few people contacted him that day, to report the scammer, which led to thousands in losses.

I also dun goofed and inserted my private key on some random website which did look legit, but it was stupid to say the least. I'm still unsure on how I fell for it, however, I was one of the lucky ones, who after conducting such a stupid move, immediately moved any funds and unstaked any assets to a new wallet.

It was a horrifying experience.

It depends how you will use telegram to be safe from hacks. You can be hack on any social media chat apps if you always clicking random links send by random user especially those who DM at most. You can set your telegram account private and auto block all those DM with links and never click any links that you will see on group chat. Just click it if it's coming from an official telegram account. You don't need to be afraid when using Telegram, Just be cautious and avoid clicking links as much possible because this what typically hackers do to scam on TG.

I have heard that a lot of crypto wallets are hacked through Telegram. Personally, this is why I don't use Telegram.
I think too many bad actors are looking for ways to exploit Telegram users. For social media, I only use Facebook and Instagram because I have heard of less incidents of hacking on those platforms.

They are everywhere.

That's why I'm not using any of them but only for certain updates with things that I've been following. But when it comes to communicating with any of those platforms.

It's always the same people that have the same tricks of telling this and that and will lead you to their scam person and links. Although I'm aware of their scam, it's annoying that they randomly come.

You are right, in fact there are many ways that they can steal your data just by clicking, because an algorithm is self-managed that searches the entire PC for what has to do with special extensions, such as .dat, and when it finds them, it may search private keys, there is now a lot of AI, which can do that search in a very short time and steal it is very easy, however this is why viruses such as Ransonware have been given, which are very common, especially in the time of 2019 and 2020, in the local Spanish section there is a very interesting thread that talks about it.

Hats off to you, for informing the community. Although I'm not using Telegram, I used to use Discord regarding some communities about staking and related services. However, I was disappointed to see that in every single group I joined, I received plenty of scam and phising attempts, one of which almost got me screwed over, which would result in quite a few thousands in losses.

As a result, I've resorted to stop using such services such as Telegram, Discord etc. due to the high risk they involve, regarding its users.

I never used telegram.  But is this different from you going to a website and clicking on it or its about the same?  I heard mixed opinions from people on say whether you visit an unsecured website... some people say its possible to get malware/keylogger that way.  Others say it is not possible or very hard because you need to not only download that file... exe file... but you also need to open it.



So for example let say your main laptop, you do all your crypto, banking and everything on it.  But you do your best to not click on dodgy links or visit dodgy websites... if you go on telegram on your laptop and get one of these messages and you download these files, is your computer compromised or not?  So if you just have windows defender and malwarebytes, that wouldn't work?  But if you have paid antivirus like kaspersky or norton, that might protect you better or its the same thing?



Also does that mean if you have online wallets on your computer, then you would get hacked as well?  Example say you have electrum or those other software wallets on your computer.  But you still need to enter your password to enter electrum.  Does that mean if your computer gets hacked, they could record all your keystrokes and everything so the moment you type in your electrum password to get in electrum to access it on your laptop, then they could literally just log in electrum themselves and send the coins easily or not?



Also this talk seems to be about android phone.  But what if its IOS?  If you have mobile wallets, can you get hacked this way as well if you using iphone?



Has any hacking like this occurred where your password manager got compromised as well?  Thus malware and keylogger seem to be the most dangerous thing to be concerned of?  Because if you get keylogger, I heard someone could record every single thing you pressed.  So essentially, they also see your screen as you type everything?

This is the most dangerous technique. There are lot of scammers that are on telegram every time and searching their victims that how to scam with peoples. I saw when we send a message in telegram group about our issue. There are lot  of peoples that pm you and told you we are from support team please tell us your issue we will resolve this. They are scammers please be aware from these persons. They get your information and tells you that send us some coins then your wallet unlocked. So, do not send us anything. They are scammers. Just block these persons. Real support managers will never PM you first.

That's the sad reality. Despite too many articles, threads, and other warnings that can be found on the web. Still, a newbie is a newbie. Without experience and very likely to get scammed. I have not also experienced but I'm a victim of those data miners that have been using websites and will eventually sell it to the market, our emails, and other data. That's why I'm also becoming careful on the websites that I sign up and once you have noticed that you're receiving random and unknown emails from spammer/hackers then you know where it came from or you should remember what's the website you are suspecting aside from telegram.

Remember that they can be smart more than us and they are so determined to succeed rather than to fail. And In fact, they do this for their living and that never make them to easily give up, they'd rather find another way to succeed.
- sending emails with link/malware
- try to communicate and make friends with people and take advantage
- some will ask for help

For now, the telegram channel is considered the den of scammers.

Hackers and scammer are always looking for new ways everytime to scam people. Telegram malware virus have been in existence for a while now. We all need to be aware of this but the beauty is you can't get scammed unless you give the scammer access. so for this reason know what to click or bot to access, as this is the way they gain access must of the time. Be careful as to what you click and access.

Clicking links is the common reason of hacking especially when it comes chatrooms, so be aware and better stay away from thus users in the telegram that keep sending messages with links and etc because you don't know what will gonna happen next. Just never trust anyone especially if its related to crypto because mostly are frauds that keep posting phishing links.

Since I started entering the crypto, I've always seen Telegram as a platform full of scammers.
I have a Telegram account as well but currently not using it for some reasons and just created one because of different projects that require you to join in their Telegram channel.

There are times as well that I receive random DM's from strangers saying that you need to download this or join this etc. and I always ignore it. The auto-download feature though is the thing that users of it must deactivate in order for them not to fall into this hacking. Well, I will still not use Telegram or there will be times but not that much so technically I'm safe from it .

I think the people most vulnerable to this attack are the people who are not running the latest version of their Anti-virus software.. because my Anti-virus will "sand-box" the executable file.. before it is executed and if it detects any funny stuff, it will block it.

The same anti-virus are running on my mobile phone and on my computer, so the actions is the same. I also get a prompt warning me that an executable file wants to be activated, so I must acknowledge if I want it to proceed.

In any way, I disabled the function just to be safe.. so thank you for that tip OP.    (Not that it is a big issue, because I use a hardware wallet and I have to confirm all transactions with a physical button press on the device) 

I hope they will but somehow, these hackers will still get prey as they will find a way to succeed. That is why we should be vigilant in our actions and carefully click links especially when it asks for login credentials as this likely ends hacking to our account. I'm not a victim of this but almost until I realize why I should have to do this as I already login my account earlier and stopped.

There are a lot of hacking mediums/tools that these hackers have made and we don't let them win.

You just need to be safe and be aware not to click any link that comes of them. If it is an unfamiliar link, you don't have to be curious with it and start clicking, just no.
There goes the hackers that will also come not just from social accounts but as well as our emails. They're almost everywhere and if you neglect the warnings being posted here, you might even be the one that will become a victim. But I wish more people are going to see these warnings so that these scammers/hackers won't have more victims.

this is the importance of reviewing the default settings in our privacy and security or data and storage features of any app that we will download and install. not only in telegram because we will never know where these hackers will come from. most of the time, we don't review those features because we are trusting that app. but even if the app is trustworthy in the market, they are also vulnerable to these malwares and other bugs, where hackers can penetrate their security protocols.

Exactly you are your own best security and having all files checked before downloading will help reduce the possibility of being hacked.
What I normally do is carry all my passwords in my head and never save any personal files online or the same password on Google doc.

More and more of these malwares are sure to be developed and protected into crypto space and the best precaution would be based on constantly taking conscious effort on what goes on, on your devices. Having a fortune right on your device makes it more than just a device but an asset of real value too. Why do people use auto downloads even? What there to miss?

On the malware, I'm thinking it's not automatically initiated as per extracting your pass codes both on custodial and non custodial wallets, including the onces used on various exchanges. We ought to watch it!

No one deliberately permits hackers to have access to his/her files, rather hackers find ways to force themselves access to your files. They do this by tricking the users to accept their malicious invites. By a way of allowing an automatic download of files from telegram is already an access granted unknowingly.
The best form of security is prevention. Both my telegram and WhatsApp apps, I have longed disabled automatic downloads for my privacy sake. I choose what I want to see and select which folder to send them after seeing, or better discard them.

When you do hold significant amount then you wouldnt really be that dumped on using up a device which is mostly been connected to internet.The best thing would be that it should really be
airgapped on the first place or do make use of some hardware wallet.Its not bad on being paranoid when it comes to the safety of your coins and even myself do always think or mind
off in advance when it comes to hacking probabilities which you should really be that careful on downloading apps and if you dont really need at all then its just right that
you wouldnt really download at all or really fan on clicking up some links on random basis.

Anyone with a substantial holding of Bitcoin should definitely keep their main wallet away from any devices that are likely to be attacked - phones are a prime target and pretty insecure in that regard. Phones are constantly being attacked with exploits, through rogue apps, backdoors and unintended glitches. That's besides all the social engineering trickery that can take place, people losing big sums of money after being craftily encouraged to install or download certain things which gives other people access to their keys. It's dangerous to use any software that has an auto download option by default and it might go on to steal all sorts of personal information.

Telegram is not bad in itself, but its only the few people who trying to misuse the application so that they could hack people's money. This does not mean that we stop using the telegram app. Infact, we should be careful in using apps, apply the recommended setting and hopefully we will remain safe.
Usually those who are careless, mostly are the ones who become easy victims of the hackers.

I heard of it and got a bit scared, but then I remembered that my solution is following exactly zero crypto-related channels in Telegram. Still, I was surprised by the news, as somehow I didn't think about the way messengers download media immediately as being a security risk. Still, though, after reading this thread, I decided to go ahead and stop the auto-download feature right now because it's a simple yet life-saving solution to this problem. Should have done it a long time ago anyway because, to be honest, it's annoying on its own, even without the malware threat. It would have been better if they made it turned off by default, though, given the malware spread.

Why does Telegram have an auto-download feature?What's the point of downloading files without the user's permission?
I remember that Telegram was being praised as the texting/social app,where you have complete privacy and your text messages are encrypted.This claim was proven wrong and Telegram messages aren't that encrypted and safe.Telegram is nothing but a slightly better alternative to Skype,if you ask me.
I've had a Telegram account,but I deleted that account.It seems to me that apps like Discord and Slack are better than Telegram.However,crypto scams and malware can be found on every texting/social media app.

There are things missing form this story.

1) It's an old piece of malware and every AV should detect it.
2) As others have said, it's a windows EXE so it should not matter to mobile

So there is something else going on.

The other issue is with phones there are soooooo many cheap android phones that have some form of backdoors installed. And with iPhones there are so many people with old un-updated / un-patched ones that still have vulnerabilities that have been fixed for months, if not years at this point.

So can things spread through telegram, yeah probably, but if you are up to date, running AV and are not using a $40 knock off phone, it's a lot harder.

-Dave

If this one is on auto download mode then its just right that Telegram would do something about this? Most of the time or basing up on experience on where executing downloads should really require that

command or action for a user to make before it do executes which I do also find odd if ever it was on auto download on that case.This is why im really hesitant on making out app downloads on my
phone or even on my desktop and then hearing this one out makes me check out my TG. lol

Hacking do becomes more and more enhanced and cant really be detected out.These hackers/scammers are getting wiser each day.

The method is actually very easy and it only takes few seconds to carry out. The hacker will send a message with a fake URL to the victim and once they click on this link, the hacker gets access to their wallet and steals all of their funds. This could be very dangerous for anyone who handles large sums of money in cryptocurrency wallets.

That's actually a good tip for everyone to follow not only on telegram but also on other messaging apps.
I always have the habit of disabling the auto media download and hence I am on the safer side anyway but as safety measure I cross checked this on all the messaging apps.
Downloading a file with malware automatically puts our device on risk. No wonder hackers could use this functionality for their benefits.
Thanks for posting this thread as it creates a good awareness among all the people reading it.

A recent study reveals that hackers can hack crypto wallets through Telegram. Hackers use the public keys of the victim’s wallet, and once they get it, they can send crypto coins to their own wallet.

Of course this should get more attention because it is very disturbing and makes almost everyone anxious and including myself.
this becomes very uncontrollable because indeed things like this sometimes in my own telegram always activate automatic downloads.
I feel this is something very dangerous threat.
one possible alternative at the moment is maybe having to disable the auto feature to narrow this down

Indeed. Having a layer of software for security protection is a good thing, but being cautious is another best thing to do to prevent such. Scammers will try and improvise their schemes so that they could push through their intentions, they are getting smarter day by day in making ways to proceed such deeds, so we must be one step ahead of them in protecting ourselves and assets.

I think the best bet is to avoid downloading anything from Telegram, I also saw the warning post in one Telegram channel and I have disabled all auto download but I will still apply additional caution and avoid manually downloading anything from Telegram, aside from too many scammers already crawling in that platform now hackers want to create more havoc! unbelievable.  

This can be new when you consider this situation in cryptocurrencies but that's nothing new to me and many other people, the hackers, and scammers can easily bind the malware in some media which can be a picture or a video. So whenever you open the media and download it, this will be executed on your phone or your computer and usually no anti-malware can detect it easily. This malware can stay running on your devices and monitor whatever you do anonymously and then send your personal information to the hacker, or this malware can collect your saved passwords keys and send all of the information. in order to stay safe from this malware you can turn off the auto-download in telegram also have some tools to monitor your network status and device's active connections.

I am always alarmed whenever I heard that a common program like Telegram can be used to victimized people out of the digital assets they are holding. As someone who had been one of the many in the victim statistics, I dread the feeling of being a helpless victim and i will never allow to undergo the same kind of experience again. Now, to a very non-techie person like me, just open your Telegram account then look for Settings and from there look for Data and Storage and you can see Automatic media download...make sure that you click the three buttons off. That's it...better be safe than sorry, guys!

That's scary because most users have the default setting of downloading any files on their telegram group automatically. By disabling those setting will help a lot. That's why I keep ignoring everything when something pops out every time I browsed the internet because of such kinds of malicious files. anyway, installing Adblock on browsers will help a lot, you just need to download it from their official website.

This whole Telegram is filled with bunch of hackers and scammers. But I doubt a "virus" can be spread automatically without having to do anything. Like another user mentioned, it's a rar file. So the user has to extract the file to infect his/her phone. So even if auto download is turned on, it's not possible to mess up your phone unless you carelessly open a random file. It also has a .exe file, so your phone can't even run it. You will have to send it to your computer and then run it. So unless you are a dimwit, I guess they can't "automatically" hack your wallet through telegram.

The 2FA won't help in this case because the malware will start taking screeshots from your screen without you get a notice about this then send them to the hacker(s). The possibility that he took a screenshot for the file where you store your private codes is quite high. So if he can get your seed for instence he won't be in need for additional security steps. Note also that Non-Custudial wallets doesn't run with an additional security measure because it's not controlled by any entity and the data are encrypted within the device itself.

Thank you OP for pointing out the issue. I am sure many users use Telegram without even knowing that media files are downloadable by default in the app settings .

To those who are recommending 2FA for securing their fund:

Bitcoin purpose is to have full control over your money. Note that with using a custodial wallet with 2FA feature, you actually give the control of your money to the service provider.
You may decrease the chance of getting hacked (if you have the 2FA application in a separate device), but you are in the danger of being scammed.

I think one of the few reasons they enable the default auto-download settings is to make user experiences more intuitive, so the user won't have to manually click the media to show what it is. Aside from the UX settings, specifically about security, I do think it is approachable to let the user particularly choose how the auto-download feature behave on the first run, not just straightly enable it. So yea, Telegram should address this issue from their side.

According to the malware report, they are also stealing wallets data instead of only credentials. So in addition of activating 2FA, anyone should really take into consideration of how they store and use any cryptocurrencies wallets.

Luckily, I don't have telegram for now since I am done using it in the past so I just uninstalled it and probably it has already been updated to disable that "auto download" part. Scammers nowadays are really trying their best to get their hands onto your wallet to steal in the process. What app would they be going to manipulate next?

I think 2FA is the best option here but I don't know something is really odd with these scammer/hacker nowadays. Makes you feel less secured if you have more apps in your computer and I don't think AV would be able to detect that.

2FA is really needed for our wallets and activate it as always. And to counter this possible threat for everyone using telegram, we can just simply turn off the automatic download.
Good thing that I've read this thread and read the replies of others of turning off the automatic download of file which includes the videos, images and other file types.

I think this is somewhat similar to the discord malware that was announced for a warning from one of the developer server that I'm into. Can't remember it clearly but it does the same as a "loading image" as they put it. I think to combat this is really having 2FA on all accounts especially if it contains money or important informations. These scammers and hackers are really that adept.

 Telegrams hacking malware have been around for some time now but I believe the hacker can not have access to files on your device unless you permit them, thanks for the information to disable that feature on my telegram right aware.
Hackers and scammers are always looking out for access to steal our security details and files.

I have to admit that I didn't know there was a desktop version of this app, but in that case, it would apply what @DdmrDdmr wrote - which means that the malware won't start automatically, but you need to unpack the rar file first and run the exe file. For exactly what this malware does on a desktop computer when it infects it you can read in the next article :

As I've checked on my telegram privacy and security it is all in the default setting allowing everyone to make a call, message, and send files (malware is possible), and auto-download is enabled. These tips give me more security to me personally and protect me from scammers sending questionable files.

Now to know that it all lies on how to manage our accounts and it is a need to check first on privacy and security setting, this could save us from these people. If we care nothing about our account, not possible to become a victim sooner or later. Immediate action should be done ASAP.

And how about the web version of the telegram running on the computer browser? If auto download is enabled on the browser, will it only affect that browser data or have the ability to get data from the hard disk or other browsers?


Discord is not widely used as telegram but yes, i do believe that the default setting of telegram should be to disable the auto download. I hope telegram may explorer this option in their later releases.

I never allow auto download feature. I would like to spend a little more time to read pop up message, then I can approve downloading or not.

On Telegram, it is a paradise for spammers and scammers so people should customize their Privacy & Security settings because in default settings, it allows everyone to call you, to see your phone number and can add you to groups & channels.

• Phone number: My contact
• Call: My contact
• Group & channels: My contact

Telegram security and privacy tips

I do not think we as regular user will know how that virus work and how can they reach our wallets. But as far as I know, when we download a file, that can contain a virus and when we execute that file, it will infect our devices and that will depend on the source code in the virus. If the virus has a command to execute or access the wallet, the virus will try to penetrate our devices and start to do something that the creator wants. So we must be careful when we download a file from the internet.

@DdmrDdmr has already noticed some illogicalities in the article, and it seems to me that this malware would not do any major damage on Android devices just by taking capture screenshots - of course, this does not apply to those who will install a crypto wallet for the first time and thus expose their seed. In addition to turning off auto-download, it is recommended that you never store large amounts of crypto in mobile/desktop wallets - and we know that Telegram has long been one of the main tools for crypto hackers.

If you can't protect yourself properly, it's better not to use such tools, in the end, you can do much more harm than good.

Thanks for sharing this important information here. I have not only applied these instructions on my own telegram account but also I have passed this information on my local board so most of the people in my local community take timely actions and avoid any potential loss of crypto.

Why is there even an autodownload in Telegram in the first place, it's definitely going to be exploited by someone eventually and here we are with the malware that can easily snake through your phone without you knowing about it. It's still crazy to me that people are still using Telegram when there's a Discord already.

Just by receiving a call on the telegram, his phone got cloned and he lost his access, that's hard to believe but if it is real, it's too much threatening. Cloning the phone means that his all data got transferred, all his passwords etc but i am sure he must have installed some malicious app as directed by the hacker on the call.

Hackers have taken cryptocurrency technology as a prey and have accomplished a lot of actions that requires taking people's funds through a fishy way.
That's why people should read wild daily for new information like this one. The victims of their recent plot got no such information about turning off the auto download button. So, cryptocurrency holders should keep their eyes on recent news from top blogs, which helps to guide everyone on cases like the malware being circulated on telegram.

Thanks for this, this is actually a good warning and I've got disabled mine already. I guess that's why there are some random people claiming they're from Europe chatting on me but I ignored them.

I'm still quite confused on how it happens but I'll just protect myself from it and thanks to this warning.

These hackers make their way to hack wallets and that seems easy especially for not techy people to fall into their trick like auto-download malware. It sometimes happens that due to our curiosity it leads to hacking like wanting to know what is inside the link and then clicking it. I think this must be seriously taken care of for now and have to be careful when someone does send anything like that as this might be malware that cost us a lot and lost control of our wallets. That is why it is very important to keep our keys separately, not stored on our PC or phones.

I remembered when I disabled auto-download even for WhatsApp, including all contents, not even only videos but also photos, audios and documents. I prefer to select and authorize the ones I want on my device. This is even still better, how about Telegram, even strangers can be able to get in touch with you, how about the unknown people on Telegram groups and the likes, I have disabled automatic media download on my Telegram account also long time ago. Just like I thought this might lead to malware installation on ones device. But, it is good to be more careful, this malware can also be installed if manually select on the malware content. I think this raises the awareness about how we should not allow any unauthorized contents to be downloaded on our device.

This is quite surprising and I think this information should be spread to more thread to avoid more victims from this kind of threat. I have seen people complain of something similar to this of losing access to their funds and suddenly everything got wiped off. We need to be careful of the kindnof group we join on social media which is not only telegram. Thanks for this information.

Thanks for this OP - I’ve just disabled mine  Just not worth taking any chances !

Thanks for this, a friend had his android phone cloned and locked him out today. He was able to later regain his phone use, but his crypto funds had been moved, I think he said he had received a call via telegram and that is all he could remember before the ugly incident. We need to be extra careful on files been downloaded.

There’s a rather more detailed explanation (*) in one of the links provided on the later referenced Twitter account that is pointed out in the article in the OP.

It explains that the file that contains the malware is called "Present).rar", containing three files itself, one of which is the malicious element (present.exe). It seems to be a windows platform potential issue in this case (not Android/iPhone), and fortunately little extended.

The auto download feature should probably be disabled for safety per se, and thus allow the user for a more granular and attention based approach. Since the file is a .rar, and then you require executing the enclosed .exe, I don’t believe that happens on its own as an automatic corollary to the download process. Rather more, I figure, It should be the user that initiates this latter procedure, although the OP’s article does argue for the whole sequence to be automatic, which I find odd:



(*) See: https://www.safeguardcyber.com/hubfs/Threat%20Intel%20Reports/Threat%20Report_Echelon%20Malware%20-%20SafeGuard%20Cyber.pdf

Hackers use malware files for attack device. They creta malwares and share on Telegram and when anyone download it then hacker got all information about device and then he control device easily and hack wallets and personal information.

Recently i was reading an article where Hackers target crypto wallets through Telegram using Echelon malware is explained.
I have followed the instructions and disabled the Automatic download of media option in telegram. But i fear that many people will keep the auto download option enable because of unaware of this threat.
I wonder how this virus will work and how can they reach to our wallets / exchanges?