Zero Day Initiative (ZDI)

New Capabilities

Relayed the disclosure and closed it after the vendor patched

A single clicked link could empty a Telegram Desktop account. The link injected hidden commands into Telegram's local socket, and three files that together unlock the login were read and uploaded to an attacker's chat. With them, the attacker could sign in as the victim.

Updated Yesterday