TWEAKOS Malware Transforms Telegram into Stealer, C2, and Stolen Account Marketplace

Key Takeaways

• TWEAKOS is a novel malware that leverages Telegram for command and control, data exfiltration, and even as a marketplace for stolen accounts.
• It targets Windows users, specifically aiming to compromise Discord accounts by stealing authentication tokens and Telegram accounts by creating reusable login sessions.
• The malware’s source code was discovered on Pastebin, revealing its dual functionality as a stealer and a Telegram-based storefront.
• Initial infection vectors remain unknown, but the malware establishes persistence without requiring administrative privileges.
• Affected users should immediately invalidate suspicious Telegram sessions, revoke Discord tokens, and enable multi-factor authentication.

TWEAKOS: A Multifaceted Threat Exploiting Telegram

A new and sophisticated malware, dubbed TWEAKOS, has emerged, demonstrating a unique operational model that transforms the popular messaging platform Telegram into a comprehensive ecosystem for data theft, command and control (C2), and even a marketplace for stolen credentials. This innovative threat combines a Windows-based information stealer with a Telegram bot, enabling threat actors to manage victims and monetize compromised accounts directly within the platform.

The existence of TWEAKOS came to light following the unexpected appearance of its source code on Pastebin. Cybersecurity researchers subsequently analyzed two Python components associated with the malware. While the exact methods by which TWEAKOS initially infects victims remain undetermined, and the full extent of its reach is still being assessed, executing the malware on a Windows system can lead to the compromise of Discord accounts and the creation of persistent, reusable Telegram login sessions.

Analysts at Flare were instrumental in connecting these disparate components, identifying shared bot credentials and operator accounts that link the stealer and the Telegram bot. This unified infrastructure allows the same Telegram bot to facilitate the theft process, provide operators with access to compromised data, and serve as a storefront for selling the illicitly gained account access.

Unlike many other malware strains that target multiple messaging platforms, TWEAKOS distinguishes itself by integrating a fully functional marketplace directly into its operational framework. This storefront enables the monetization of stolen access, creating a seamless pipeline from compromise to sale. A stolen Telegram session file effectively grants an attacker the ability to impersonate the legitimate account holder, while a valid Discord token provides unauthorized access to the victim’s Discord account.

In a report shared with Cyber Security News (CSN), Flare said in a report that their researchers confirmed the presence of both stealing and marketplace capabilities within the TWEAKOS code. However, they were unable to verify if the exposed Telegram bot remained actively accessible at the time of their analysis.

TWEAKOS Malware’s Operational Mechanics

Upon infecting a Windows system, the TWEAKOS stealer ensures its persistence by configuring itself to execute automatically at user login. This is achieved either by copying a packaged executable into the user’s Startup folder or by adding a user-level startup entry for its script version. Crucially, neither of these methods requires elevated administrative privileges, making it easier for the malware to maintain its presence across system restarts.

The malware then initiates a scan for Discord authentication tokens. It specifically targets local storage locations utilized by the Discord application, its test build, and the default profile of the Chrome browser. Any tokens discovered are validated against Discord’s API, and confirmed active tokens are then exfiltrated to the operators via Telegram. It is important to note that the Chrome search conducted by TWEAKOS is narrowly focused; it does not attempt to extract stored browser passwords, cookies, or the browser’s encryption keys, a departure from the broader browser data theft observed in other Discord stealer campaigns. TWEAKOS prioritizes obtaining and verifying active Discord tokens, transmitting the associated account identity along with them.

Beyond Discord, TWEAKOS also attempts to hijack Telegram accounts. This process, however, necessitates direct interaction from the compromised user. The program prompts the victim for their phone number and a login code. Should the account be protected by a cloud password, it will request that as well. These details are then used to authenticate through the Telethon library, generating a new Telegram session. If a session file already exists, a copy is sent to two operator accounts, allowing them to reuse the established login.

While the malware might generate a new password string if one is absent, it does not actually modify the victim’s account password. This distinction is critical: the primary risk is unauthorized access through a valid session, not a forced password reset. The research report does not specify any particular delivery mechanism or lure used to distribute the TWEAKOS malware.

Inside the Telegram Storefront

The second Python component of TWEAKOS manages the Telegram bot, maintaining a local database that records details of victims, buyers, available products, and completed transactions.

This integrated shop facilitates the sale of stolen Telegram and Discord accounts. It generates invoices in Telegram Stars, a virtual currency, and automatically delivers the purchased credentials to buyers once payment is confirmed. To incentivize sales, prices for compromised accounts are dynamically reduced by 5% daily, potentially reaching a maximum discount of 70%, with a minimum price of one Telegram Star.

This model of using Telegram as a marketplace for stolen credentials has been observed in previous reporting, but TWEAKOS uniquely integrates the storefront directly with its stealing operations. Operators possess the capability to review victim records, send messages, and even activate a script that displays a persistent warning message on a victim’s screen. The malware’s code also references a supposed “security update” payload, though researchers were unable to recover this file or ascertain its functionality.

The integration between the theft mechanism and the record-keeping system is not flawless. Stolen data is directly transmitted to operator chats, while the bot’s database handler primarily processes incoming messages from non-operators. Furthermore, the Discord token validation performed by the bot expects different capitalization than the output from the stealer. Consequently, the bot’s database might not accurately reflect all compromised accounts, even if the operators have successfully received the details.

For cybersecurity investigations, Flare advises prioritizing operator chat records over relying solely on the bot’s database for a complete picture of compromised accounts. Defenders should remain vigilant for unusual startup entries, attempts to access Discord token storage followed by validation requests, and new Telegram traffic coinciding with the appearance of new session files.

What You Should Do

• Invalidate Telegram Sessions: If you suspect your Telegram account might be compromised, immediately go to Settings > Devices > Terminate All Other Sessions.
• Revoke Discord Tokens: Change your Discord password, which will invalidate all existing tokens. Consider enabling two-factor authentication (2FA).
• Enable Multi-Factor Authentication (MFA): Implement MFA on all critical accounts, especially messaging platforms like Telegram and Discord, to add an extra layer of security.
• Be Wary of Suspicious Requests: Exercise extreme caution with unexpected requests for login codes, cloud passwords, or any personal information, particularly within messaging apps.
• Monitor Startup Programs: Regularly check your Windows startup programs for any unfamiliar or suspicious entries.
• Update Software: Keep your operating system, web browsers, and messaging applications updated to their latest versions to patch known vulnerabilities.
• Use Reputable Antivirus/EDR: Ensure you have a robust antivirus or Endpoint Detection and Response (EDR) solution installed and actively scanning your system.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.