Telegram

Reported Context (2)

Command-and-control runs over a Telegram Bot API polling loop, with AES-GCM payloads over certificate-pinned TLS. macOS.Gaslight Uses Prompt Injection to Disrupt AI-Assisted Malware Analysis
outgoing registration tokens, spoof device identities (phone numbers), and exfiltrate 2FA data to Telegram. Crucially, the module uses Socket.IO for real-time Command & Control (C2), allowing attackers to LSPosed Module Bypasses UPI SIM Binding to Enable Payment Account Takeovers

Malware (6)

Threat Actors (3)

MITRE ATT&CK (7)

Vendors (5)

Products (17)

Tools (2)

Industries (1)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.