One-Click Telegram Flaw Exposes Real IP Addresses, Bypassing Proxies on Android and iOS

Telegram’s mobile clients contain a stealthy flaw that enables attackers to unmask users’ real IP addresses with a single click. This vulnerability bypasses proxy protections, exposing even individuals attempting to conceal their location. Dubbed a “one-click IP leak,” it transforms seemingly innocuous username links into potent tracking weapons.

The issue hinges on Telegram’s automatic proxy validation mechanism. When users encounter a disguised proxy link, often embedded behind a username (e.g., t.me/proxy?server=attacker-controlled), the app pings the proxy server before adding it.

Crucially, this ping bypasses all user-configured proxies, routing directly from the victim’s device and exposing their true IP. No secret key is required, mirroring NTLM hash leaks on Windows, where authentication attempts betray the client.

Cybersecurity expert @0x6rss demonstrated an attack vector on X (formerly Twitter) and shared a proof-of-concept: a 1-click Telegram IP Leak. “Telegram auto-pings the proxy before adding it,” they noted. “Request bypasses all configured proxies. Your real IP is logged instantly.”

How the Attack Unfolds

Attackers craft malicious proxy URLs and mask them as clickable usernames in chats or channels. A targeted user clicks once, triggering:

• Automatic proxy test: Telegram sends a connectivity probe to the attacker’s server.
• Proxy bypass: The request ignores SOCKS5, MTProto, or VPN setups, using the device’s native network stack.
• IP logging: Attacker’s server captures the source IP, geolocation, and metadata.

Both Android and iOS clients are vulnerable, affecting millions who rely on Telegram for privacy-sensitive communications. No user interaction beyond the click is needed; it’s silent and effective for doxxing, surveillance, or deanonymizing activists.

This flaw underscores risks in proxy-heavy apps amid rising state-sponsored tracking. Telegram, with over 950 million users, has yet to publicly patch it. Similar bypasses have plagued apps like Signal in the past.

Mitigations:

• Disable auto-proxy detection in settings (if available).
• Avoid clicking on unknown usernames/links.
• Use firewall rules to block outbound proxy pings (e.g., via Little Snitch on iOS or AFWall+ on Android).
• Monitor for patches via Telegram’s changelog.

Researchers urge immediate fixes. Telegram did not respond to requests for comment by press time.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.