Telegram Web

Reported Context (3)

Socket draws attention to the Telegram Multi-account extension, which steals the active Telegram Web session and allows the attackers to take over the user account by overwriting the local storage with attacker-supplied Socket Finds 108 Malicious Chrome Extensions, More Than 20,000 Installs
Some extensions include startup backdoors that fetch remote commands and one actively steals and swaps Telegram Web sessions. Researchers Find 100+ Malicious Chrome Extensions Targeting Google and Telegram Accounts
account for about 20k installs under five publisher identities, exfiltrating Google identities, Telegram Web sessions, browsing data, and opening attacker-specified URLs. Researchers Link 108 Malicious Chrome Extensions to Shared C2 and Data Theft

MITRE ATT&CK (6)

Vendors (3)

Products (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.