Operation Navy Ghost: How Attackers Planted a Telegram-Powered Backdoor Across Fake pyrogram Packages on PyPI

**Operation Navy Ghost**: Multiple trojanized pyrogram forks published to PyPI injected a hidden file (pyrogram/helpers/secret.py) that registers Telegram handlers allowing attacker-owned Telegram IDs to run arbitrary Python and shell commands and exfiltrate data via the bot (reply_document). Several packages (vlifegram, vlife-gram, kelragram, pyrogram-navy, pyrogram-styled, sepgram, pyrogram-zeeb, pyrogram-kelra) were found and removed from PyPI; the report provides IOCs (malicious Telegram user IDs and channel), a YARA rule, detection/remediation steps, and advice to rotate credentials and audit affected systems.