The Telegram Malware Ecosystem

Telegram's Bot API has become the preferred, infrastructure-free C2 channel for malware operators, whose embedded bot tokens and chat IDs—routinely leaked in malware samples—enable defenders to passively map, cluster, and attribute nearly 10,000 Telegram-based malware campaigns, including MaaS operations and account-takedown services, without ever touching victim data.