Critical Telegram Desktop Flaw Enabled Full Account Takeover
TREE NEWS reports: Security researcher BeakSec has disclosed a high-severity vulnerability in Telegram Desktop, tracked as CVE-2026-107181, that allowed attackers to hijack user accounts through a two-stage social engineering and command-injection chain. Versions 7.2.8 and earlier were affected; the fix landed in version 7.2.9, released on September 17.
How the Attack Chain Worked
The exploit did not rely on a memory-corruption bug, but on Telegram’s own inter-process communication (IPC) layer. An attacker would first plant a specially crafted instruction file inside a group chat the victim already belonged to. The victim was then lured into clicking a link that redirected through the browser, ultimately triggering a command injection via IPC. That injection caused the desktop client to send local files to a group controlled by the attacker.
The most damaging target was Telegram’s session file. If an attacker obtained it and the victim had not enabled a local passcode, the session could be imported elsewhere, giving the attacker full control of the account — messages, contacts, and any linked services.
Why This Matters Beyond One App
Telegram is a critical piece of infrastructure for the crypto industry. Token communities, DAO governance threads, OTC deal rooms, and developer coordination all run through it. A compromised account is not just a privacy problem; it is an operational-security event that can cascade into wallet drain or social-engineering attacks on counterparties.
- Session theft bypasses two-factor authentication when no local passcode is set.
- Attackers can impersonate trusted admins inside project groups.
- Malicious files can be distributed to contacts who trust the compromised account.
The incident also highlights a broader pattern: as crypto users harden wallets and hardware keys, attackers increasingly target the messaging layer that connects them. Desktop clients, which store persistent session data on disk, remain a softer target than mobile apps with stronger OS sandboxing.
What Users and Projects Should Do
Telegram users should update to 7.2.9 or later immediately and enable a local passcode as a second layer of defense. Projects that run large community groups should audit admin permissions, rotate any credentials shared through chat, and train moderators to recognize link-based lures. For the crypto sector, the episode is a reminder that operational security is a chain, and the weakest link is often the app everyone treats as routine.
