The Telegram Malware Ecosystem

This report describes a large-scale intelligence collection and analysis of malware using the Telegram Bot API for exfiltration and command-and-control: 9,898 observations (9,756 unique samples) yielded 9,678 bot tokens and 6,512 destination chats, with passive Bot API enrichment revealing chat metadata, admin/creator IDs, commands, webhooks and hosted panels; clustering produced 854 operator campaigns and multiple case studies including a TonConnect crypto-drainer MaaS and a MasRep takedown service, highlighting high-impact pivots (webhooks, hosted panels) and sensitive exposures (positive chat_ids that reveal operator user_ids).