This is not related to malware on TG but I just got a detected login to my one account today at 5 am (was sleeping just got awake from the call) which was the very first time to happen in my tg account.
- First i got a message from tg of login code that someone trying to access my account, this is only will happen if they know your number knowing this number were including on different breached like Ledger so probably many have this number of mine on their db lists
- then after minute someone call from overseas i didnt answer of course since i didnt know who was it.
- moments later i got new message of detected login from new device "Telegram Android, 11.5.3 MBOX Android 11 (30)"
- set 2fa (received a message on this too)
- then i noticed an email was linked as well which i never did before, probably it was from that user
So what i did is;
- first go to device then terminate the session of the new device, just after i received the call (after a woke up)
- removed the email, it was snipped i can't fully see the email id just the first and last character, then i changed it to mine (first time doing that)
- add passcode
- then reset 2fa
This account is not my main tg never had any convo to strangers i just used it to test my TG bots, since i know this number was leaked to different list already but it weirded me out that just a missed call from unknown number it got successfully login to the account. Which i think that instead of passcode from the app, the call (probably from telegram) was used for the verification then logged in.
Note my privacy settings were all set to "nobody", so no one can see my phone number, calls, last seen, contact list, etc.
This is the number used with label "Malaysia"