<![CDATA[Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists]]>

<![CDATA[Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists]]>Cybersecurity agencies from the United States, the United Kingdom, and the Netherlands have jointly detailed a Windows malware attributed to Iran's intelligence service. According to the advisory, the tool is used to spy on dissidents, journalists, and activists worldwide.

The malware stands out for its command-and-control mechanism: it is controlled through the Telegram messaging app rather than traditional infrastructure. Once deployed on a Windows system, its capabilities include:

Copying the target's emails and chat messages
Taking screenshots
Activating the microphone to record audio

The joint advisory underscores the continued targeting of civil society figures by state-sponsored actors, with Telegram abuse giving operators a low-profile channel for issuing commands and exfiltrating data.

Source: The Hacker News

Does your organization block or monitor Telegram traffic on endpoints, and would that even help against this threat?

]]>https://xploitlk.com/topic/352/iranian-hackers-use-telegram-controlled-malware-to-spy-on-dissidents-and-journalistsRSS for NodeTue, 27 Oct 2026 08:51:27 GMTWed, 16 Sep 2026 04:30:21 GMT60