Likho Stealer’s New Toolkit Steals Telegram Sessions and Records Conversations

Key Takeaways

• A new “Still Toolkit” by the Armored Likho cyber-espionage group targets individuals and organizations primarily in Russia.
• The malware, delivered via a deceptive donation application, steals Telegram session data and records ambient audio.
• This campaign enables persistent surveillance, allowing attackers to access chat histories, files, contacts, and spoken conversations.
• The attack leverages Rust-based components, “Still Sync” for Telegram data exfiltration and “Still Audio” for microphone surveillance.
• Mitigation involves immediately isolating infected devices, reviewing Telegram sessions, and blocking known Indicators of Compromise (IoCs).

A sophisticated cyber-espionage campaign attributed to the threat actor Armored Likho is actively deploying a novel “Still Toolkit.” This operation primarily targets entities within Russia, employing a convincing fake donation application as its initial vector. Once executed, the malicious software surreptitiously installs tools designed to compromise Telegram accounts and clandestinely record private conversations.

This campaign represents a significant threat due to its dual capability: gaining persistent access to communication platforms and enabling real-time audio surveillance. Victims risk losing not only their entire chat histories, shared files, and contact lists but also having their spoken discussions captured, posing severe privacy and business integrity risks. Unlike typical data exfiltration operations that are “smash-and-grab,” this toolkit allows adversaries to maintain long-term surveillance over a target’s communications, building a comprehensive profile of personal or organizational activities. Such persistence dramatically amplifies potential harm, especially for individuals with access to sensitive projects, proprietary data, or critical decision-making processes across various public and private sector organizations.

Securelist said in a report, which was shared with Cyber Security News (CSN), that their researchers uncovered this campaign in May 2026. The new Rust-based Still Toolkit was identified during an investigation into malicious activities targeting private citizens, corporations, government entities, IT firms, and educational institutions within Russia.

While the exact initial delivery mechanism remains unconfirmed, the social engineering lure is a familiar one. Victims are tricked into downloading what appears to be a legitimate charitable donation application. Upon launch, they encounter a password entry screen and a catalog of items, lending credibility to the fake software, even as the hidden malicious payload begins its operations in the background.

Armored Likho’s Still Toolkit

The Still Toolkit comprises several components, with “Still Sync” being the primary module for Telegram exploitation. This component specifically targets Telegram Desktop session data. By acquiring this information, attackers can hijack an already authenticated account, circumventing the need for the victim’s login credentials. This danger highlights the ongoing risks associated with cloned Telegram sessions and the importance of robust authentication practices.

Once access is established, Still Sync leverages Telegram’s application programming interface (API) to exfiltrate a wide array of sensitive data. This includes account details, private chat logs, group conversations, channel content, and media files up to 250MB in size. Furthermore, the malware can gather names, phone numbers, membership lists, documents, stickers, photos, and contact information, transforming a single endpoint compromise into a rich source of intelligence.

Initially, the malware registers the compromised device with its command-and-control (C2) server, awaiting instructions to activate its data collection features. It meticulously searches both standard and portable Telegram installation directories. Should direct file access prove difficult, it can resort to backup-based methods, emphasizing that the absence of a file permission prompt does not guarantee safety.

This method differs significantly from traditional password phishing. Instead, it exploits locally stored authentication tokens, which is why recent incidents involving Telegram authentication phishing and session theft require vigilance, even when two-step verification (2FA) is enabled. Implementing a separate desktop passcode for locally stored Telegram data can provide an additional layer of protection.

Audio Module Extends Surveillance Capabilities

The “Still Audio” module introduces a second, more intrusive layer of espionage by continuously monitoring the device’s microphone for speech. When ambient sound surpasses a predefined threshold, the module initiates recording. It maintains a brief audio buffer to ensure the beginning of a conversation isn’t missed, converts the captured audio into an MP3 format, and then transmits it to the attacker’s infrastructure.

While designed to operate discreetly as a Windows service, researchers observed that the module did not entirely mask its microphone usage. In the analyzed samples, the program appeared within Windows microphone settings under a name resembling a legitimate audio component. This subtle indicator serves as a crucial clue during incident response investigations.

The Still Audio module also incorporates a resilient fallback mechanism, allowing operators to switch to alternative C2 server addresses if the primary connection remains unavailable for three consecutive days. This adaptive resilience mirrors tactics seen in ClickFix malware delivery chains, where modular threats dynamically fetch new functionalities or replacement infrastructure rather than relying on a single, fixed server.

Researchers established a link between the current campaign and Armored Likho (also known as Eagle Werewolf) through similarities in code and infrastructure with previous operations. The group’s adoption of this integrated toolkit aligns with a broader trend in Rust-based malware surveillance campaigns: compact, modular threats capable of collecting diverse forms of sensitive data following a single deceptive user interaction.

What You Should Do

• If you suspect you have installed a suspicious donation application, immediately disconnect the affected device from all networks.
• Preserve all potential evidence on the device and have it thoroughly examined by a trusted cybersecurity team.
• From a clean, uncompromised device, review your Telegram’s “Active Sessions” and terminate any unfamiliar or suspicious entries.
• Reset all relevant passwords, especially for your Telegram account and any associated email or services.
• Assume that chats and audio recordings may have been exposed and take appropriate measures, such as notifying contacts or stakeholders.
• Organizations should proactively block all provided Indicators of Compromise (IoCs) at their network perimeter and endpoints.
• Conduct thorough threat hunting across your environment for any related activity and promptly notify any potentially affected users or personnel.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.