Telegram zero-day allowed sending malicious Android APKs as videos

A Telegram for Android zero-day dubbed "EvilVideo" let attackers craft APKs that appeared as 30-second video files; ESET obtained a PoC, identified a C2 (infinityhackscharan.ddns.net) and malicious APKs on VirusTotal, and responsibly disclosed the flaw. Telegram patched the issue in v10.14.5 (July 11, 2024); the attack requires several user actions (tap preview, open external player, enable unknown app installs), which reduces risk despite a reported five-week window where actors could have exploited the bug.