Telegram Sessions Targeted Through Malicious PowerShell Script

Researchers analyzed a PowerShell 'Windows Telemetry Update' script that locates Telegram Desktop session folders, collects host metadata, compresses session files to TEMP\diag.zip, and uploads them to an attacker-controlled Telegram bot; a separate web-based collector harvesting Telegram Web auth keys was also linked to the same infrastructure. The artifacts show low sophistication (plain-text bot credentials, no persistence, un-obfuscated code) and appear to be a validation/testing capability rather than a widely deployed campaign, though the capability enables account takeover if successful.