Kaspersky Catches Silent Malware Targeting Telegram Desktop Users

Russian security firm Kaspersky Lab has uncovered previously undetected malware, targeting users of the desktop version of the popular messaging app Telegram. The malicious software has specifically targeted Russian users since March 2017, designed to trick them into using their machines to mine cryptocurrencies like Monero and Zcash. Telegram ranks among the world's top mobile messaging apps and is projected to reach 200 million users in 2018, although only its desktop computer version was compromised in this attack.

Kaspersky Detects Stealth Malware Targeting Telegram Desktop Users

Moscow, Russia - Kaspersky Lab, a leading cybersecurity firm, has identified and analyzed a previously undetected malware strain targeting users of the Telegram desktop messaging application, the company announced on Tuesday.

The malicious software, operational since March 2017, has primarily targeted Russian users. Its primary objective has been to surreptitiously enlist victims' computers into a network for mining cryptocurrencies, specifically Monero and Zcash.

Telegram, boasting over 200 million active users worldwide, ranks as the ninth most popular mobile messaging platform. Notably, the malware only affects the desktop version of the application, which is distinct from the mobile app.

The malware's modus operandi revolves around exploiting a specific feature within Telegram's desktop software that facilitates the recognition of Arabic and Hebrew scripts, which are read from right to left. By employing a hidden character that reverses the order of characters, attackers were able to rename files, subsequently triggering the installation of the malware.

Kaspersky's investigation into the malware's code revealed connections to a Russian cybercriminal group. The firm emphasized that the vulnerability exploited in this attack is not exclusive to Telegram, as a similar vulnerability was recently discovered in WhatsApp.

Upon discovering the vulnerability, Kaspersky promptly notified Telegram in October, and the issue was subsequently addressed and resolved.

According to a statement released on Telegram's technical channel, the attack employed social engineering tactics, reliant on users being tricked into downloading a malicious image file. Telegram implemented a fix for the vulnerability in November.

"This is not a genuine vulnerability within Telegram Desktop," the statement asserts. "Your computer or Telegram account cannot be remotely compromised unless you open a (malicious) file," Telegram emphasized.

Meanwhile, Telegram is reportedly preparing for a substantial initial coin offering (ICO), involving the private sale of tokens that will function as an alternative currency, akin to Bitcoin or Ethereum. An investment proposal reviewed by Reuters estimates that the ICO has the potential to raise up to $2 billion.

The successful detection and analysis of this malware by Kaspersky Lab underscores the ongoing threat of cyberattacks and the importance of robust cybersecurity measures. Users are urged to exercise caution when downloading files from unknown sources and to keep their software up-to-date.