Exploiting the #EvilVideo vulnerability on Telegram We discovered a 0-day Telegram for Android exploit that allows sending malicious apps disguised as videos ESET Research ESET

@ESET We found the EvilVideo exploit being advertised for sale on an underground forum since Jun 6, 2024. Price wasn't included.

@ESET The exploit rely on the threat actor being able to create a payload that displays an Android app as a video and not as a binary attachment. Once shared in chat, the malicious payload appears as a 30-second video

@ESET If user tries to play the “video”, Telegram displays a message that it is unable to play it and suggests using an external player. If the user taps the Open button, payload will request to install a malicious app disguised as the external player.

@ESET Report timeline [06-06-2024] EvilVideo advertised for sale on an underground forum [26-06-2024] Reported to Telegram [11-07-2024] Fixed (v10.14.5)

@ESETresearch @ESET @telegram @jbfxdotme