First Ever: Android Baohuo Backdoor Hides in Telegram X Clone, Uses Redis Database for C2 Commands

Cybersecurity researchers have identified Android.Backdoor.Baohuo.1.origin hiding in maliciously modified versions of the Telegram X messenger, operating through a Redis database for remote command execution alongside traditional C2 servers. The campaign began circulating in mid-2024 and uses in-app advertising to lure users into trojanised APKs from fake app stores, with redirects from banners to malicious sites where the trojan APK is downloaded.

Doctor Web notes that the backdoor can steal credentials, chat histories, and clipboard data, and can grant attackers full control of the victim’s account and messenger functionality. The Redis-based C2 mechanism is described as the first known use of Redis to control Android malware, enabling command, configuration updates, and payload changes through database channels.

Telemetry from Doctor Web indicates more than 58,000 devices across 3,000 Android models have been infected worldwide, with primary victims in Brazil and Indonesia.