TeleRAT: Another Android Trojan Leveraging Telegram’s Bot API to Target Iranian Users
Summary: Unit 42 documented a new Android trojan family it named TeleRAT, which uses Telegram's Bot API both for command and control and for data exfiltration via the sendDocument method, unlike the earlier IRRAT family that used the API only for commands. The researchers identified 2,293 victims across the infrastructure they analyzed, 82% of them with Iranian phone numbers, with samples distributed through third-party Android app stores and Iranian Telegram channels.
What you should know: Because all traffic, including stolen data uploads, goes through Telegram's bot API, network detection based on known upload servers no longer applies - and the API keys hardcoded in the APKs let researchers pull bot command histories tied to four Telegram accounts.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026