Hackers Don’t Crack Telegram 2FA—They Copy Your Already Logged-In Session

A macOS information-stealing malware campaign exfiltrates Telegram Desktop session files and other sensitive data (Keychain, browser credentials, notes, and cryptocurrency wallet databases). By copying and restoring Telegram's local tdata files to another Mac, attackers can resume authenticated sessions and bypass Telegram two-step verification; additionally, attackers deploy fake wallet applications and prompts to harvest recovery phrases and passwords. SlowMist reproduced the attack and provided IoCs (IP addresses, URLs, and SHA-256 hashes) for detection and mitigation.