According to a newsroom post by cybersecurity firm Eset, Telegram for Android had a zero-day vulnerability. A zero-day vulnerability is a security flaw which is unknown to the developer. The term is used since developers have “zero days” to patch the issue. This particular vulnerability was reportedly found by some malicious actors who were trying to sell it on the dark web.
“We found the exploit being advertised for sale on an underground forum. In the post, the seller shows screenshots and a video of testing the exploit in a public Telegram channel. We were able to identify the channel in question, with the exploit still available. That allowed us to get our hands on the payload and test it ourselves,” said ESET researcher Lukáš Štefanko, who discovered the exploit.
Dark Web Post About the Telegram Vulnerability
Dubbed EvilVideo, the exploit allowed hackers to deploy malware payload as Android Package (APK) within the video files, based on the dark web post spotted by Welivesecurity. When played, Telegram reportedly would show a message that says “App was unable to play this video.” However, immediately afterwards, the hidden malware would send request to allow apps from third-party sources so it could be installed, revealed the publication.
Since the default option on Telegram downloads videos by default, the researchers believe the payload could have been easily spread to a large number of users by planting them in large public groups.
However, Eset notified Telegram about the exploit on June 26, and reportedly, Telegram released an update on July 11, patching the vulnerability.