Telegram Messenger Abused by Android Malware to Seize Full Device Control

According to Doctor Web, security researchers uncovered a sophisticated Android backdoor disguised as Telegram X that grants cybercriminals full control over victims’ accounts and devices. Identified as Android.Backdoor.Baohuo.1.origin, the malware has infected more than 58,000 devices worldwide, with around 20,000 active infections currently monitored, and introduces unprecedented control via Redis database integration for command delivery.

The backdoor primarily spreads through malicious websites masquerading as app catalogs, luring users with fake advertisements promising dating and video chat features. Approximately 3,000 different models of smartphones, tablets, TV box sets and even cars with Android-based on-board computers have been infected, with compromised Telegram X versions surfacing on third-party stores such as APKPure, ApkSum and AndroidP under the official Telegram developer’s identity despite differing digital signatures.

Unusually, the malware can add and remove users from Telegram channels and join chats on the victim’s behalf while concealing these actions from the user, and operates through three modification variants ranging from embedding in the messenger’s main executable to dynamic loading via the LSPatch tool. The backdoor uploads device permissions, screen status, and Telegram authentication credentials every three minutes, signalling a global reach with Brazil and Indonesia as primary infection vectors.