Researchers at threat-intelligence firm Flare have documented a malware family, tracked as TWEAKOS, that treats Telegram as infrastructure end to end: delivery mechanism, command channel, and now a live marketplace for the accounts it steals.
What happened
TWEAKOS ships in two forms. A packaged Windows build drops a copy of itself into the user's Startup folder; a lighter script-based version adds a persistence entry to the current user's Registry Run key instead. Both approaches survive a reboot, and neither needs administrator rights, which keeps the malware inside normal user-level activity that many endpoint controls don't scrutinize closely.
Once running, the malware searches Discord's local storage — the standard client, Discord's test build, and Chrome's default profile — for authentication tokens. It doesn't stop at collection: each token is checked against Discord's own API, and only the ones still valid are forwarded to the operators over Telegram. Notably, it ignores saved browser passwords, cookies, and the browser's encryption keys entirely — a narrower, more surgical grab than a typical browser stealer, apparently built to move fast and avoid the noisier detection signatures tied to full credential dumps.
A second module goes after the Telegram account directly. It prompts for a phone number and login code and, if the account has cloud-based two-factor protection enabled, for that password too — then uses those inputs to open a fresh, authenticated session via the Telethon library and hands a copy to two operator accounts. One detail matters for incident response: the malware can display a newly generated password string without ever actually changing the account's real password. A stolen session is not the same as a reset password, and treating it as one can send responders down the wrong remediation path.
The stolen goods don't just pile up — they're sold. A separate Python component runs a Telegram bot backed by a local database that tracks victims, buyers, listed accounts, and completed orders. Discord and Telegram accounts are listed for sale and invoiced in Telegram Stars, with prices dropping 5% a day up to a 70% discount and a one-Star floor; buyers receive credentials automatically once payment clears. Operators can browse victim records from the same bot and, for pressure tactics, trigger a script that puts a repeating warning message on a victim's screen. Flare also found a reference to a "security update" payload the operators can push, but the file itself wasn't recovered, so its actual function is unconfirmed.
The operation isn't seamless end to end. Stolen data flows straight into operator chats, while the bot's own database logic checks Discord tokens using different capitalization than the stealer produces — meaning the recordkeeping can miss compromised accounts that operators already have in hand. Flare's guidance for anyone investigating a case: check chat logs, not just the database.
Why it matters
TWEAKOS is a small but telling example of attackers consolidating their toolchain onto platforms defenders already treat as "normal" traffic. Using Telegram's own API for command-and-control and stolen-file transfer means outbound connections blend in with legitimate chat traffic instead of lighting up as contact with a dedicated C2 server. Pairing that with a token-only approach to Discord theft, and persistence that never needs elevated privileges, makes TWEAKOS a quieter operator than the average infostealer — and a reminder that "no admin rights required" is not the same as "low severity."
What to do
- Watch startup locations. Flag new entries in the user Startup folder or
HKCU\...\Run— particularly ones namedSystemHelperor similar generic system-sounding strings. - Correlate Discord token access with outbound validation calls. Local reads of Discord's token storage followed shortly by requests to Discord's API endpoint for account info is a strong combined signal.
- Watch Telegram traffic after new session files appear. Traffic to
api.telegram.orgimmediately following the creation of a.sessionfile on an endpoint is worth an alert. - Treat unsolicited 2FA prompts as an active incident. A request for a Telegram login code or cloud password the user didn't initiate should be escalated immediately, not dismissed as routine.
- If compromise is suspected: invalidate all active Telegram sessions, revoke and rotate any exposed Discord tokens, and enable multi-factor authentication on both platforms.
- Don't trust a single source during investigation. Bot databases seized from operations like this can under-report victims; cross-check against operator chat logs wherever possible.