beaksec

Independent security researcher who discovered and disclosed the vulnerability

Appears in 1 story

Stories

Telegram Desktop flaw let one crafted link take over an account

Disclosed the flaw; published the technical writeup October 3, 2026

A single clicked link could empty a Telegram Desktop account. The link injected hidden commands into Telegram's local inter-process socket, and three files holding the user's login were read and uploaded to an attacker's chat. With those files, the attacker could sign in as the victim.

Updated 1 hour ago