Threat Actors Abuse Telegram Bots to Steal and Exfiltrate Credentials
Summary
Cofense documents Telegram Bot API abuse by phishing pages and malware to exfiltrate credentials and files, with examples including Agent Tesla, WSH RAT and Pure Logs Stealer. It also describes bot investigation methods and defenses.
Key points
- Credential phishing pages can submit captured form data to Telegram bots through sendMessage; the observed requests can expose bot authorization tokens and chat IDs.
- Agent Tesla samples use sendDocument to upload files containing credentials; the article says they accounted for 77.7% of 2024 ATRs with Telegram C2.
- WSH RAT-related download pages were observed sending host information to Telegram, while some Pure Logs Stealer samples associated with Lone None used bot profiles to provide second-stage payload paths.
- Cofense reports that Telegram was used as C2 in 3.8% of malware-based ATRs and 2.3% of credential-phishing ATRs from Q1 2024 through Q2 2025.
- Analysts with a bot authorization token and chat ID can use getMe, getUpdates and forwardMessage to identify bots and access or forward bot messages.
- Suggested mitigations include training users to report suspicious messages, links and attachments, and blocking or monitoring requests to api.telegram[.]org/bot when Telegram bots are not needed.
Article Details
- Attack Vectors
- Credential phishing forms submit captured data to attacker-controlled Telegram bots using the sendMessage API.
- Agent Tesla Keylogger uploads files containing stolen credentials through Telegram’s sendDocument API.
- WSH RAT-related download pages send victim host information to a Telegram bot.
- Pure Logs Stealer uses Telegram bot profiles to provide paths to second-stage payloads hosted on paste.rs.
- Defensive Notes
- Train users to avoid and report suspicious messages, links, and attachments.
- Where Telegram Bot API use is not legitimate, block or monitor requests to api.telegram.org/bot endpoints and methods such as sendMessage and sendDocument.
- Investigators with a bot authorization token and chat ID can use getMe, getUpdates, and forwardMessage to examine bot activity and historical messages.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//api[.]telegram[.]org/bot1900392974:AAEB_yGGlWksNcNC4Dg08OgUSlmDON2w098/sendDocument | Telegram Bot API URL used by an Agent Tesla Keylogger sample to upload files containing stolen credentials. |
| URL | hxxps[:]//api[.]telegram[.]org/bot7004434365:AAGMJLpdyYvb4CDZLQ47zbh0pRB_CC-Hwro/sendMessage | Telegram Bot API URL used to send victim host information to a threat actor's bot. |
| URL | hxxps[:]//paste[.]rs/qDTxA | Specific paste.rs resource identified as hosting a malicious second-stage Python script. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelMalware and scripts exfiltrate stolen data to attacker-controlled Telegram bots over the Bot API.T1056.001 · KeyloggingThe article describes keyloggers capturing keystrokes and sending them to threat actors through Telegram.T1071.001 · Web ProtocolsHTTPS requests to the Telegram Bot API are used for bot communications and data exfiltration.T1105 · Ingress Tool TransferA Telegram bot profile provides part of a URL used to load a malicious second-stage Python script from paste.rs.T1566 · PhishingCredential phishing pages collect form input and submit it to a Telegram bot.T1567 · Exfiltration Over Web ServiceStolen text and files are uploaded to Telegram through API methods such as sendMessage and sendDocument.
Threat Actors
Malware
Agent Tesla KeyloggerAgent Tesla Keylogger is a prominent example, using sendDocument to upload aggregated stolen credentials and accounting for 77.7% of 2024 ATRs with Telegram C2.Pure Logs StealerThe article describes how threat actors abuse the Telegram Bot API to exfiltrate credentials and files from phishing pages and malware families such as Agent Tesla, WSH RAT, and Pure Logs Stealer.WSH RATThe article describes how threat actors abuse the Telegram Bot API to exfiltrate credentials and files from phishing pages and malware families such as Agent Tesla, WSH RAT, and Pure Logs Stealer.