Telegram channel Archives

AppWizard

June 3, 2026

Malware campaign targeting Minecraft users infects over 116,000 systems

A recent investigation by McAfee researchers has identified a Malware-as-a-Service (MaaS) operation called WeedHack, which targets Minecraft users. Since its launch in January 2026, WeedHack has compromised over 116,000 systems, with 2,000 to 3,000 new infections daily. The operation uses YouTube and SEO poisoning to distribute malware, promoting Minecraft mods and utilities through videos. WeedHack is accessible for free, with premium features available at low costs. The malware targets Minecraft session IDs, collects system information, and extracts credentials from various platforms. It includes a web-based dashboard for tracking infections and offers tools for injecting malware into legitimate mods. The operation has also been linked to incidents of cyberbullying among its users. McAfee advises caution when engaging with Minecraft-related content on YouTube.

AppWizard

June 3, 2026

Over 116,000 Mincraft systems infected in WeedHack malware campaign

A malware operation called WeedHack has targeted Minecraft players since January, compromising over 116,000 systems with daily infections between 2,000 and 3,000. It primarily distributes malware through malicious mods, clients, cheats, and utilities promoted on YouTube, utilizing SEO poisoning to reach victims. The campaign features polished YouTube videos with embedded download links and targets keywords related to popular Minecraft clients. WeedHack operates as a malware-as-a-service (MaaS) model, offering a free tier that steals Minecraft session IDs, cookies, and passwords across various platforms, and a premium tier with enhanced capabilities. The operation's Telegram channel has over 800 members, mostly teenagers or young adults. Minecraft players are advised to trust only official sources for mods and verify download links to protect against these threats.

AppWizard

March 17, 2026

Russian Officials Use Burner Phones to Avoid State Messaging App Surveillance

Russian officials are increasingly using separate phones and SIM cards to install the state-backed messaging app, Max, due to growing distrust of the platform among government employees and state enterprise managers. Reports indicate that many officials prefer not to install Max on personal devices, often acquiring additional smartphones specifically for this purpose. Some officials register for the app using their regular numbers but continue to use separate devices for communication, and the most cautious avoid syncing contacts with their work phones. The pressure to adopt Max extends to the education sector, where students at Moscow Pedagogical State University are compelled to register for the app, with threats to their diploma access if they refuse. The university has started moving academic communication to the state messenger, with messages from the dean's office stressing the importance of registration. Additionally, a document from the Ministry of Education instructs institute directors to hold meetings with students regarding Max. Resistance is also seen in the military, with reports of servicemen in the Donetsk region refusing to comply with orders to install the app.

AppWizard

February 26, 2026

Russia’s “Secure” Max App Flagged as Security Risk, Troops in Ukraine Told to Stop Using It

Russian military personnel in Ukraine have been advised against using the state-sponsored messaging application, Max, due to security concerns raised by pro-war military bloggers. Directives have been issued to prohibit the use and installation of Max, described sarcastically as the “most secure national messenger in the world.” An alternative communication program is expected to be introduced for frontline use, although details remain undisclosed. The Russian Digital Development Ministry has noted that while Telegram will not be blocked for troops, foreign intelligence agencies may access its correspondence, posing risks for the Russian military. The Federal Security Service has warned that Ukraine’s military could obtain information shared via Telegram, which could be used for tactical advantages.

AppWizard

February 23, 2026

The Kremlin spent years building a messenger to replace Telegram. Now it’s reportedly telling soldiers the substitute is too insecure to use at the front.

Russian military personnel have been advised to stop using the messaging application Max due to security concerns, as reported by Mediazona. This recommendation follows intensified restrictions on Telegram, which began in the summer of 2025. The Federal Security Service (FSB) has warned that Ukrainian forces can intercept Telegram communications, prompting worries about the safety of sensitive information. Access to Telegram has been increasingly limited, with plans for further restrictions on media file access reported by RBC. Pro-war advocates, including Sergey Mironov, have criticized these limitations and defended Telegram as a reliable communication tool. Despite the Kremlin's claims that troops do not rely on Telegram, the Russian Defense Ministry asserts that they use standard communications equipment and a domestically developed messenger. On February 18, Russian Digital Development Minister Maksut Shadaev stated that Telegram would not be blocked for frontline use for now.

AppWizard

February 12, 2026

As Kremlin Throttles Telegram, Russians Stand to Lose More Than Just Messaging

Russian state media regulator Roskomnadzor has increased scrutiny of the messaging app Telegram due to concerns about fraud and user data security. Telegram has 93.6 million users in Russia, more than 60% of the population, and is essential for news, communication between officials and the public, and operational communication during the Ukraine conflict. Major news outlets have dedicated Telegram channels, and users can customize their news experience. Government officials use Telegram for direct updates, while opposition politicians and Ukrainian President Volodymyr Zelensky utilize it to communicate with supporters. Telegram is crucial for both Russian and Ukrainian troops for tactical coordination. The platform also hosts a variety of bloggers and is widely used for workplace communication. Despite government efforts to control Telegram, many users continue to access it through VPNs.

AppWizard

February 11, 2026

Telegram is one of the last messaging apps in Russia that the state doesn’t control. Did the Kremlin just block it for good?

Telegram has experienced significant disruptions in Russia over the past two days due to interventions by the federal censorship agency, Roskomnadzor, which aims to “protect” citizens. Reports indicate that Russian authorities have initiated partial restrictions on Telegram, actively slowing the service. Telegram has faced multiple misdemeanor cases for not removing prohibited content, and Roskomnadzor has accused it of not complying with Russian legislation. For two consecutive days, users reported outages, with issues such as media files failing to load and messages not being sent or received. A poll revealed that about 21 percent of respondents experienced problems with the app, while 38 percent noted no issues, and 23 percent used a VPN to remain unaffected by restrictions. Over the past six months, Telegram and WhatsApp have faced numerous limitations from Roskomnadzor, including the blocking of audio and video calls. Reports in January 2026 indicated that Telegram was being deliberately slowed down, linking the restrictions to alleged legal violations. The Kremlin's actions to limit independent messaging platforms coincide with the promotion of Max, a state-controlled alternative, which has struggled to gain a comparable user base. Despite denials of plans to fully ban Telegram or WhatsApp, experts suggest that gradual tightening of restrictions may render these apps effectively unusable. The popularity of Telegram's channels may prevent a complete ban, as government officials continue to rely on the platform for communication.

AppWizard

December 1, 2025

Android malware Albiriox abuses 400+ financial apps in on-device fraud and screen manipulation attacks

A new malware-as-a-service (MaaS) called Albiriox has emerged, targeting banking and cryptocurrency applications, particularly focusing on Austrian users. It is marketed on the dark web and employs deceptive tactics, such as mimicking legitimate businesses and creating fake landing pages and app listings on the Google Play Store. Victims are tricked into providing their phone numbers, leading to the delivery of a malicious APK file via SMS or WhatsApp. This APK acts as a dropper, designed to bypass detection methods and requests permissions under the guise of a “software update” to download the actual malicious payload. Once installed, it can take control of the device or function as an infostealer, extracting sensitive information like phone numbers and passwords, which is sent to a Telegram channel. Cleafy researchers suggest that the Albiriox campaign is linked to Russian cyber actors based on their activities on cybercrime forums and communication style.

AppWizard

October 24, 2025

New Python-Based RAT Disguised as Minecraft App Steals Sensitive User Data

Threat researchers at Netskope have identified a new Remote Access Trojan (RAT) named “Nursultan Client,” disguised as a legitimate application for Minecraft enthusiasts. This malware, developed in Python, uses the Telegram Bot API for command-and-control operations, enabling data exfiltration and persistent access to compromised systems. It was first detected as a 68.5 MB executable compiled with PyInstaller, which is often used for legitimate software but can also bundle malicious scripts. Upon execution, the RAT misleads users with a fake installation progress bar. Its core functionalities operate across Windows, Linux, and macOS platforms, targeting the gaming community through social engineering tactics. The malware contains hardcoded Telegram credentials, allowing attackers to issue commands to infected machines while obscuring their communications. The RAT can execute various commands, including stealing Discord authentication tokens and conducting system reconnaissance. It also offers surveillance capabilities, such as capturing screenshots and webcam images, and has adware functionalities that can open URLs or display pop-up messages. The operation appears to be aimed at lower-tier threat actors, lacking advanced anti-analysis techniques and sophisticated tradecraft. Organizations are advised to monitor encrypted traffic and educate users on software authenticity to mitigate risks.

AppWizard

October 11, 2025

Google blocks Android hack that let Pixel users enable VoLTE anywhere

In October 2025, Google updated its software, rendering the Pixel IMS app inoperative for users of imported Pixel phones in unsupported regions. This app had previously allowed users to enable VoLTE and VoWiFi by bypassing carrier restrictions. The update closed a loophole in Android's telephony framework, classified as a high-severity issue (CVE-2025-48617), leading to crashes when users attempted to toggle these features. While a new workaround exists for enabling VoLTE, it does not support VoWiFi and requires navigating instructions in Chinese. Users needing VoWiFi must either root their devices or wait for Google's official expansion of carrier support.