Here is How Analysts Use Telegram API to Intercept Data Exfiltrated by Malware

ANY.RUN researchers demonstrate how malware leverages Telegram (and similar apps) to exfiltrate data by capturing API POST requests in a sandbox, extracting bot tokens and chat_id values, checking/removing webhooks, and using the /forwardMessage method to copy attacker-sent messages; the article includes sandbox-derived JSON responses and IOCs and highlights ANY.RUN features for interactive malware analysis.