A recent security analysis revealed a critical vulnerability in the Telegram app for Android, where harmful files could be camouflaged as innocuous video clips.
This security loophole, identified by a cybersecurity team from Slovakia and nicknamed “EvilVideo,” was addressed by Telegram in the update to version 10.14.5, following the team’s disclosure.
Cyber adversaries had a window of approximately five weeks to leverage this flaw before its resolution. The actual exploitation of this vulnerability remains uncertain, according to the cybersecurity team’s report.
The discovery of this security issue was first made on a clandestine digital marketplace in early June. An individual using the alias “Ancryno” offered this exploit for sale, demonstrating its functionality through visual evidence and a demonstration video within a public Telegram group.
In versions of the Telegram app for Android that had not been updated, this exploit could be utilized to transmit harmful data through Telegram’s various communication channels, presenting them as standard multimedia files.
The exploit capitalized on Telegram’s auto-download feature for media files, which users could deactivate. However, even with this feature turned off, the harmful data could be downloaded if a user interacted with the file’s download prompt.
Attempting to view the “video” would result in Telegram indicating an error and suggesting the use of an alternative media player. This is where the attackers cleverly masked their harmful application as the suggested media player.
With the release of the updated Telegram app, any such malicious files are now accurately identified as applications, not videos, within chats.
Details regarding the identity of the cybercriminals interested in this exploit, their intended use, and its overall efficacy remain undisclosed.
Additionally, the same online profile that brought attention to this exploit has been linked to the promotion of a cryptomining service for Android, claimed to be completely stealthy by the cybersecurity researchers.
Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com
