Malicious PyPI Pyrogram Forks Add Backdoor to Telegram Bot Servers

Summary

Checkmarx reports that Operation Navy Ghost published at least eight trojanized Pyrogram forks on PyPI. Their secret.py backdoor can run Python or shell commands with an infected bot’s permissions and access files, secrets, and Telegram data.

Key points

Checkmarx says the campaign published at least eight malicious Pyrogram forks on PyPI between November 2025 and June 2026.
A hidden secret.py file in the helpers module registers Telegram command handlers and activates when Pyrogram is imported or an infected bot starts.
The backdoor can execute attacker-supplied Python or shell commands under the infected application’s authority and return output through Telegram.
Researchers say the malware can read server files, access Telegram chats, retrieve databases and secrets, and install a persistent backdoor.
Checkmarx attributes the packages to one actor based on shared Telegram IDs in an OWNERS list, identical backdoor code, command names, and overlapping infrastructure.
Checkmarx advises developers who installed the packages to remove them, rotate affected server credentials, and revoke Telegram bot tokens.

Article Details

Attack Vectors: Trojanized Pyrogram forks published on PyPI contain a backdoor in the helpers module’s secret.py file.
The backdoor activates when Pyrogram is imported or an infected Telegram bot starts, and registers hidden Telegram command handlers.
The handlers execute attacker-supplied Python or shell commands on the compromised server and return command output through Telegram; larger output is sent as a document attachment.
Defensive Notes: Remove any of the listed malicious PyPI packages from affected environments.
Rotate credentials on affected servers and revoke their Telegram bot tokens.

MITRE ATT&CK

T1005 · Data from Local SystemThe backdoor can read arbitrary files and access or download data, including databases, from the compromised server.T1041 · Exfiltration Over C2 ChannelThe backdoor returns command output to the attacker through Telegram messages or document attachments and can exfiltrate accessible data.T1059.004 · Unix ShellThe backdoor executes attacker-supplied shell commands, including commands run through /bin/bash -c.T1059.006 · PythonThe backdoor executes attacker-supplied Python code on the infected server through a hidden Telegram command handler.

Malware

secret.pyThe hidden backdoor, secret.py, can execute attacker-supplied Python or shell commands, steal files and secrets, and exfiltrate data from infected servers.

Products

PyPIA campaign dubbed Operation Navy Ghost has been targeting Python developers who build Telegram bots by publishing trojanized Pyrogram forks on PyPI.PyrogramA campaign dubbed Operation Navy Ghost has been targeting Python developers who build Telegram bots by publishing trojanized Pyrogram forks on PyPI.TelegramA campaign dubbed Operation Navy Ghost has been targeting Python developers who build Telegram bots by publishing trojanized Pyrogram forks on PyPI.