Telegram App Vulnerability Exploited to Spread Malware via Videos

A zero-day security flaw in Telegram’s mobile app for Android, dubbed EvilVideo, was exploited to spread malware disguised as harmless-looking videos. This vulnerability was discovered by ESET researchers and has since been addressed by Telegram, highlighting the importance of swift action in cybersecurity.

Discovery and Exploitation

The EvilVideo exploit was first identified on an underground forum on June 6, 2024, where it appeared for sale. The flaw allowed attackers to use Telegram’s application programming interface (API) to upload malicious Android payloads that appeared as multimedia files. When users clicked on these files, they were shown a warning message stating the video could not be played and suggesting they try an external player. If the user proceeded, they were prompted to install an APK file named “xHamster Premium Mod,” thereby unknowingly downloading malware.

Lukáš Štefanko, a security researcher at ESET, detailed how attackers could share these malicious files via Telegram channels, groups, and chats. The payload was cleverly disguised to exploit Telegram’s multimedia sharing feature, making it appear as a benign 30-second video. This deceptive tactic was facilitated by Telegram’s API, which enabled programmatic uploads of multimedia files to chats and channels.

User Impact and Mitigation

One of the critical aspects of this exploit was its ability to download malware automatically for users who had enabled the automatic download of media files. Štefanko noted, “By default, media files received via Telegram are set to download automatically.” This meant that users with this setting enabled would automatically download the malicious payload upon opening the conversation where it was shared.

Even for users who had disabled automatic downloads, the payload could still be downloaded by tapping the download button accompanying the supposed video. Notably, this attack vector did not affect Telegram clients for the web or the dedicated Windows app, limiting its impact to Android users.

Following the responsible disclosure of the flaw on June 26, Telegram acted quickly to patch the issue. The fix was included in version 10.14.5, released on July 11, 2024. Users are strongly advised to update their Telegram app to the latest version to avoid potential exploitation.

Broader Context of Cyber Threats

The exploitation of the EvilVideo vulnerability is part of a broader trend of cybercriminals targeting popular platforms to distribute malware. In another related incident, cybercriminals capitalized on the popularity of the Telegram-based cryptocurrency game, Hamster Kombat, to spread malicious software.

Hamster Kombat, which launched in March 2024, quickly gained over 250 million players. This rapid growth made it an attractive target for cybercriminals. ESET researchers discovered fake app stores promoting the game, GitHub repositories hosting malware disguised as automation tools, and an unofficial Telegram channel distributing an Android trojan named Ratel.

Ratel, distributed via a Telegram channel named “hamster_easy,” impersonated the game and prompted users to grant it notification access and set it as the default SMS application. Once installed, Ratel contacted a remote server to obtain a phone number and send a Russian language SMS message, likely to the malware operators. This allowed the operators to control the compromised device via SMS, sending messages, making calls, and even checking the victim’s banking account balance.