Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

Android malware (.apk) can be spread through a fake video by manipulating the Telegram file extension. I showed how it is done in the video below.

0x6rss

17,495 subscribers

180,816 views • 2 years ago •via X (Twitter)

Science & Technology News & Politics

Anya Rossi• Live Now

Private livecam show

10 Comments

0x6rss2 years ago

Hackers are selling this method underground under the name "Telegram video exploit".

bl4ckh4ck52 years ago

Makes me curious what Bitdefender mobile would do with that

Daps 🦙🔥2 years ago

Do you have the POC on GitHub ?

CYBERTR0N 🛡️2 years ago

Link bro ?

talalalal2 years ago

Vay anasını sayın seyirciler

Yakuß CemiL ♂2 years ago

hll

Vagrant2 years ago

I thought tg already patched this?

Name2 years ago

data: be like

Smukx.E2 years ago

neat and legit malware ;)

rizal rasmalian2 years ago

Cool, all infos about the "hole" in a vid,i succeed to reconstruct the"hole" and create my own Telegram-Exploit, also why i can "see" the "hole" because like we talked,it's similar to Whatsapp "hole" i found. So now, we have Telegram Exploit and Whatsapp Exploit, what's next? :D

Related Videos

Recently, I discovered a campaign spreading via Telegram Mini Apps. In fact, a threat actor attempted to phish me using this tactic.👇 The technique is highly convincing because it involves a trust boundary violation in Telegram’s MiniApp SDK (affecting Android, Desktop, iOS, and Web versions). Telegram allows third-party code to use its trusted native UI through showPopup(), but it does so without clearly indicating the source to the user or providing safeguards against abuse. This constitutes a design weakness, as the triggered pop-up belongs to Telegram and can be used in an arbitrary manner. -The attacker misleads the user by leveraging Telegram’s own native UI component. -The popup is rendered outside the MiniApp iframe, within Telegram’s own UI layer. -The user perceives it as a legitimate warning from Telegram itself. -By placing a single button, the attacker can redirect the user to a phishing page. -Since the phishing page opens inside the Mini App, the phishing URL is not visibly exposed. After conducting detailed research, I simulated this attack and demonstrated it in the video below. Be cautious when opening Mini Apps in bots.

Recently, I discovered a campaign spreading via Telegram Mini Apps. In fact, a threat actor attempted to phish me using this tactic.👇 The technique is highly convincing because it involves a trust boundary violation in Telegram’s MiniApp SDK (affecting Android, Desktop, iOS, and Web versions). Telegram allows third-party code to use its trusted native UI through showPopup(), but it does so without clearly indicating the source to the user or providing safeguards against abuse. This constitutes a design weakness, as the triggered pop-up belongs to Telegram and can be used in an arbitrary manner. -The attacker misleads the user by leveraging Telegram’s own native UI component. -The popup is rendered outside the MiniApp iframe, within Telegram’s own UI layer. -The user perceives it as a legitimate warning from Telegram itself. -By placing a single button, the attacker can redirect the user to a phishing page. -Since the phishing page opens inside the Mini App, the phishing URL is not visibly exposed. After conducting detailed research, I simulated this attack and demonstrated it in the video below. Be cautious when opening Mini Apps in bots.

0x6rss

49,167 views • 5 months ago

Dear threat hunters and malware analysts, Threat.Zone | Holistic Malware Analysis Platform , a Holistic Malware Analysis Platform, allows you to capture the Telegram C2 network requests of the XWORM malware and hunt the logs using Matkap! ➡️

Dear threat hunters and malware analysts, Threat.Zone | Holistic Malware Analysis Platform , a Holistic Malware Analysis Platform, allows you to capture the Telegram C2 network requests of the XWORM malware and hunt the logs using Matkap! ➡️

0x6rss

22,313 views • 1 year ago

Hey threat hunters and malware analysts! The web version of Matkap is now live! You can now hunt malicious Telegram bots via Happy hunting!

Hey threat hunters and malware analysts! The web version of Matkap is now live! You can now hunt malicious Telegram bots via Happy hunting!

0x6rss

62,598 views • 1 year ago

The exercise I see BUTCHERED most often in the gym is Leg Press Video 1 is how 99% of people do it Video 2 is how it SHOULD be done

The exercise I see BUTCHERED most often in the gym is Leg Press Video 1 is how 99% of people do it Video 2 is how it SHOULD be done

Dean Turner

581,657 views • 3 months ago

A fake AI generated video of Pakistan’s Information Minister is being spread by anti-Pakistan accounts. I am sharing the original video.

A fake AI generated video of Pakistan’s Information Minister is being spread by anti-Pakistan accounts. I am sharing the original video.

Wajahat Kazmi

18,847 views • 9 days ago

Exposing the FAKE NEWS being spread by the Congress ecosystem on the 2030 Commonwealth Games. Let’s get the facts straight& know in this video how a host city is selected by Commonwealth Selction Committee: 🇮🇳 It is NOT “Ahmedabad vs Haryana.” 🇮🇳 It is NOT a state hosting the Games. 🇮🇳 It is INDIA that is to host the 2030 Commonwealth Games. Details in the video:

Exposing the FAKE NEWS being spread by the Congress ecosystem on the 2030 Commonwealth Games. Let’s get the facts straight& know in this video how a host city is selected by Commonwealth Selction Committee: 🇮🇳 It is NOT “Ahmedabad vs Haryana.” 🇮🇳 It is NOT a state hosting the Games. 🇮🇳 It is INDIA that is to host the 2030 Commonwealth Games. Details in the video:

Pradeep Bhandari(प्रदीप भंडारी)🇮🇳

76,067 views • 4 days ago

i've build a 130 million parameter world model that can beat the average player in polytopia. here is a quick demo video i made. explaining a bit how it works and how i run it in the terminal through cli agents like BLACKBOX AI so i can play the model in a hybrid mode with llm's. more about it below :)

i've build a 130 million parameter world model that can beat the average player in polytopia. here is a quick demo video i made. explaining a bit how it works and how i run it in the terminal through cli agents like BLACKBOX AI so i can play the model in a hybrid mode with llm's. more about it below :)

Aimar Haddadi

12,674 views • 3 months ago

The Rabbit R1 uses Android under the hood. Someone shared Rabbit R1's launcher APK with Android Authority, and with a bit of tinkering, they managed to install it on an Android PHONE (Pixel 6A) Entire interface users interact with is powered by a single Android app. Video Credit: Android Authority Source: Android Authority

The Rabbit R1 uses Android under the hood. Someone shared Rabbit R1's launcher APK with Android Authority, and with a bit of tinkering, they managed to install it on an Android PHONE (Pixel 6A) Entire interface users interact with is powered by a single Android app. Video Credit: Android Authority Source: Android Authority

AshutoshShrivastava

162,305 views • 2 years ago

Video: Zamfara Youths being Paid ₦10,000 Each and Given New Android Phones to Promote Governor Dauda Lawal and Spread Propaganda. This shows that Dauda’s administration may be manipulating public opinion by incentivizing youths to disseminate misleading information in the state

Video: Zamfara Youths being Paid ₦10,000 Each and Given New Android Phones to Promote Governor Dauda Lawal and Spread Propaganda. This shows that Dauda’s administration may be manipulating public opinion by incentivizing youths to disseminate misleading information in the state

SAMBO MAI HULA

101,815 views • 10 months ago

Yesterday’s #ZeroDayRAT demo showed a 1‑click Android 15 exploit Real or fake? I don't know. If it is real, cleanup could be a problem.

Yesterday’s #ZeroDayRAT demo showed a 1‑click Android 15 exploit Real or fake? I don't know. If it is real, cleanup could be a problem.

Mobile Hacker

12,000 views • 5 months ago

hi threat hunters and malware analysts! I want to introduce you to my newly developed tool called "Matkap". with this tool, you can infiltrate telegram bots(malbots) associated with malware, gain access to their messages, and extract all their logs! ➡️

hi threat hunters and malware analysts! I want to introduce you to my newly developed tool called "Matkap". with this tool, you can infiltrate telegram bots(malbots) associated with malware, gain access to their messages, and extract all their logs! ➡️

0x6rss

192,192 views • 1 year ago

Here is a little video I made using the new Grok video feature where you can animate more than one image in a video. I also published an article below so you can see how I did it. Very simple! Lots of fun 🙂

Here is a little video I made using the new Grok video feature where you can animate more than one image in a video. I also published an article below so you can see how I did it. Very simple! Lots of fun 🙂

G. Kim

739,936 views • 4 months ago

More Extremely Important Information here ⬇️ - In fact we must not download any apk file from any unknown number whether ,it is a wedding card or anything, such scam also happened during Ram mandir Inauguration time , when scammers sent apk files claimed to be a priority visiting pas . - Such malware will activate mirroring applications where anything going on in your screen will be visible to the scammers devices, that’s how they can take all your personal & financial data . - Tell this information especially to your parents because many Parents are very innocent and they do not know much about such techy things . - Not only apk files but also any unknown links we should not click on , which we get from Unknown numbers. - Point to consider here is , usually the wedding cards Come in Pdf form or document form or photo or a video not through APK . Source of the Video : The Times of India E news paper

More Extremely Important Information here ⬇️ - In fact we must not download any apk file from any unknown number whether ,it is a wedding card or anything, such scam also happened during Ram mandir Inauguration time , when scammers sent apk files claimed to be a priority visiting pas . - Such malware will activate mirroring applications where anything going on in your screen will be visible to the scammers devices, that’s how they can take all your personal & financial data . - Tell this information especially to your parents because many Parents are very innocent and they do not know much about such techy things . - Not only apk files but also any unknown links we should not click on , which we get from Unknown numbers. - Point to consider here is , usually the wedding cards Come in Pdf form or document form or photo or a video not through APK . Source of the Video : The Times of India E news paper

Mohini Of Investing

24,382 views • 1 year ago

Just walked through Union Station in DC for the first time in years, and I can’t believe it... It’s clean, safe, and beautiful. Exactly how it should be. A place Americans can be proud of. It used to be overrun by homeless people and drug addicts. Now it’s a place I can bring my family. Well done, Trump Administration. Well done.

Just walked through Union Station in DC for the first time in years, and I can’t believe it... It’s clean, safe, and beautiful. Exactly how it should be. A place Americans can be proud of. It used to be overrun by homeless people and drug addicts. Now it’s a place I can bring my family. Well done, Trump Administration. Well done.

Benny Johnson

928,797 views • 9 months ago

Dear Pakistanis, do not skip this video. I already showed how your data leaks & your WhatsApp account gets stolen by a simple link, but many found it confusing because it was all done in a terminal. So I made a new video that shows exactly how you can get hacked. I request all Pakistanis to watch it till the end and share it with your friends and family.

Dear Pakistanis, do not skip this video. I already showed how your data leaks & your WhatsApp account gets stolen by a simple link, but many found it confusing because it was all done in a terminal. So I made a new video that shows exactly how you can get hacked. I request all Pakistanis to watch it till the end and share it with your friends and family.

Daniel Zahoor

13,416 views • 1 month ago

How to create your Based Agent with 0 lines of code Recorded a quick demo video to show how easy it is and walk you through the entire process step-by-step All the links are in the comment below

How to create your Based Agent with 0 lines of code Recorded a quick demo video to show how easy it is and walk you through the entire process step-by-step All the links are in the comment below

lincoln.base.eth

148,805 views • 1 year ago

How to fill SIR form. Clear explanation in the below video. RT to spread the awareness.

How to fill SIR form. Clear explanation in the below video. RT to spread the awareness.

𝐒𝐚𝐟𝐟𝐫𝐨𝐧 𝐒𝐚𝐠𝐚𝐫 𝐆𝐨𝐮𝐝

12,691 views • 1 month ago

Here's the video where Blessingceo showed a fake medical report. A terribly “edited” result. At least, if you want to fake it, let it be professional🤦😀

Here's the video where Blessingceo showed a fake medical report. A terribly “edited” result. At least, if you want to fake it, let it be professional🤦😀

RAZOR BLADE

73,606 views • 4 months ago