Critical Pyronut Package Backdoors Telegram Bots via RCE

Key Takeaways

• A malicious Python package, pyronut, was discovered targeting developers of Telegram bots.
• It impersonated the legitimate pyrogram framework to deliver a sophisticated runtime backdoor.
• The backdoor enabled Remote Code Execution (RCE) for attackers, allowing arbitrary Python and shell commands on victim systems.
• Researchers at Endor Labs swiftly identified and quarantined all three malicious versions (2.0.184, 2.0.185, 2.0.186) on March 18, 2026, minimizing exposure.
• Affected developers must immediately uninstall the package, rebuild environments, and revoke all compromised credentials and API tokens.

Malicious Pyronut Package Targets Telegram Bot Developers with Runtime Backdoor

A cunning supply chain attack recently surfaced on the Python Package Index (PyPI), involving a malicious Python package named pyronut. This package was engineered to specifically compromise developers building Telegram bots, masquerading as the widely used pyrogram framework.

Sophisticated Impersonation and Distribution

Unlike typical typosquatting attempts, where a malicious package uses a name subtly different from a legitimate one, the threat actor behind pyronut employed a more deceptive strategy. They meticulously copied the entire project description of pyrogram, creating what security researchers have dubbed a “malicious fork” or “trojanized copy.” This approach aimed to ensnare victims through social engineering rather than accidental mistyping.

The legitimate pyrogram framework boasts an impressive average of 370,000 monthly downloads, making it an attractive target for such impersonation schemes. The malicious pyronut package mirrored pyrogram‘s project page precisely, notably lacking any new features and pointing to a non-existent GitHub repository URL. This strongly indicates that the package was not intended for organic discovery but was likely distributed actively through Telegram communities and developer forums. Three malicious versions—2.0.184, 2.0.185, and 2.0.186—were published.

Swift Detection and Quarantine

Researchers at Endor Labs detected all three malicious versions on March 18, 2026, the very day they appeared on PyPI. Their rapid response led to the packages being quarantined within hours, significantly curtailing the attack window and limiting the number of developers exposed to the threat. Despite the swift action, any developer who executed their bot with the pyronut package during this brief period faced full compromise.

Stealthy Runtime Activation

What made pyronut particularly insidious was its sophisticated runtime activation mechanism. Unlike many malicious packages that deploy harmful code via setup.py hooks during installation, pyronut remained completely dormant post-installation. It only activated when a developer actually launched their Telegram bot. The package embedded a hidden backdoor module at pyrogram/helpers/secret.py, which would silently load whenever the Telegram client initiated, thereby circumventing conventional install-time security scans.

The ramifications of a successful infection were severe. Upon backdoor activation, attackers gained dual Remote Code Execution (RCE) capabilities, allowing them to execute arbitrary Python code and shell commands on the victim’s machine. This level of access could facilitate credential theft, data exfiltration, lateral movement within networks, and complete hijacking of the victim’s active Telegram session.

Runtime Backdoor: How the Attack Operated

The backdoor’s activation was ingeniously tied to the moment a developer invoked the Client.start() method, a fundamental step in initializing any pyrogram-based Telegram bot. The threat actor had modified this critical method within pyrogram/methods/utilities/start.py to covertly import and execute the hidden secret.py module each time a client started. Crucially, this entire call was encapsulated within a bare try/except: pass block, ensuring that any errors encountered by the backdoor would fail silently, allowing the bot to continue normal operation without raising suspicion.

Once active, the backdoor registered two concealed message handlers on the victim’s Telegram client, linked to specific hardcoded attacker account IDs. The first handler, triggered by the /e command, leveraged the meval library to execute arbitrary Python code within the live session. This granted the attacker full access to messages, contacts, and all Telegram API functions. The second handler, activated by the /shell command, relayed commands directly to /bin/bash via subprocess, providing the attacker with unrestricted system-level access. A clear indicator of malicious intent was the backdoor’s design to skip installation on the attacker’s own accounts.

Command outputs were discreetly transmitted back to the attacker via Telegram itself, with results appearing in the same chat where commands were issued. This method of communication ensured that the operation generated no unusual external network connections, suspicious DNS queries, or identifiable C2 domains, making the backdoor exceptionally difficult to detect through conventional network monitoring tools.

What You Should Do

• Immediate Uninstallation: Developers who may have installed pyronut should immediately uninstall the package.
• Environment Rebuild: Rebuild all affected virtual environments from a clean, verified state.
• Credential Rotation: Treat all environment variables, API keys, SSH keys, and database passwords accessible to the compromised process as exposed and rotate them without delay.
• Session Termination: Terminate all active Telegram sessions and revoke all Bot API tokens immediately.
• Dependency Review: Regularly review dependency files (e.g., requirements.txt, Pipfile, pyproject.toml) for any unexpected or unauthorized packages.
• Hash Pinning: Employ lockfiles with cryptographic hash pinning to prevent silent substitutions of packages.
• Least Privilege: Run applications under the principle of least privilege to minimize the impact of any potential compromise.
• SCA Tools: Integrate Software Composition Analysis (SCA) tools into CI/CD pipelines to detect and mitigate similar supply chain attacks proactively.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.