Attackers Exploit 'EvilVideo' Telegram Zero-Day to Hide Malware

ESET researchers discovered a zero-day "EvilVideo" vulnerability in Telegram for Android (<= 10.14.4) that allowed attackers to upload crafted multimedia which rendered as a video preview but contained an Android payload; when a user attempted to play the video and chose to open it in an external player, they could be prompted to install malware. Telegram issued a server-side fix for 10.14.5+, ESET published IoCs on GitHub, and users are advised to update and avoid opening unsolicited media.