company
Telegram is a cloud-based messaging app with encrypted chats, channels, and a bot API, sometimes abused by malware for command-and-control.
No evidence-backed relationships are recorded.
ThreatDown says the Carbonato worm breaks into Docker daemons open on port 2375 and installs the open-source Hermes AI agent, then rescans nearby networks every five minutes to spread. An operator drives each infected host over Telegram.
Reality
CARBONATO, a Docker botnet running since October 2024, hijacks hosts on open port 2375 and steals keys from 14 AI providers to fund its own LLM gateway. ThreatDown found the crew's own container registry exposed, handing defenders 4.3 GB of its toolchain.
Perspective Coverage
3 publishersReality
Group-IB says the RemControl Android banking trojan reaches bank customers in six countries and the Middle East via Meta ads and fake Google Play pages. Its server address sits in a Telegram dead-drop, so the operator can move infrastructure without a new build.
Perspective Coverage
4 publishersReality
OpenClaw's Telegram enabled flag stopped inbound polling while cron-driven sends kept firing hourly through three stale bot accounts, one operator reports. The dashboard showed the channel off, and the sends ended only when the bot tokens left the secrets directory.
Reality
NCSC, FBI and AIVD say two Iranian spyware families report to per-victim Telegram bots and exfiltrate through Vultr, Storj and Backblaze B2. Networks already allow those services, so detection has to rely on host behaviour such as new Defender exclusions.
Reality
One developer's audit of a self-hosted OpenClaw agent found four ports Docker opened past ufw and watchdog crons using about 1,340 LLM turns a week. The repairs bind container ports to loopback, and the author now measures agent cost as quota by counting task runs.
Reality
Kyle Spitze drew the maximum on every count, served consecutively, in a case that reached the FBI through a Discord referral. Escalation paths now feed maximum-penalty prosecutions.
Reality
Russian drones hitting Kyiv's shared exchange buildings took at least four ISPs down together and left about 100,000 households with internet problems. Providers that share a building fail as one, taking with them the phone alerts that warn residents of the next strike.
Reality
Treasury puts Xinbi's throughput above $24bn since 2022 and TRM Labs says $36bn, but the Secret Service and Elliptic have frozen $52.8m, and the last two guarantee markets designated this way were replaced rather than removed.
Perspective Coverage
3 publishersReality
ExPatch says Telegram Desktop wrote bot button text into HTML chat exports without escaping it from March 2024 until a July fix, and updating the app leaves every file the earlier builds wrote unchanged on disk.
Reality
Group-IB says the Iran-linked leak-and-brag front Handala Hack runs HEAVYGRAM, a Python implant that takes orders from a Telegram bot, opens the microphone and lifts saved passwords after a loader writes Defender exclusions for it.
Perspective Coverage
9 publishersReality
Kaspersky says the macOS stealer it first tracked as Mac.c has swapped script droppers for FAT Mach-O binaries in a chain found in September 2026, and its loader now reads shell commands out of a public iCloud calendar file.
Reality
Elliptic and the US Secret Service froze 52 wallets holding $52.8 million in USDT on September 8. US sanctions followed a day later, Telegram deleted the channels the same day, and Xinbi says it is moving to a stablecoin nobody can freeze.
Reality
The company known for a pocket gadget now ships a cloud agent that installs on up to five Windows, macOS or Linux machines and runs on whatever model subscription the user already pays for. Four rival agents got there first.
Reality
Rabbit has stopped making the R1 and moved its agent into a cloud service that touches desktop files through a local node. Jesse Lyu says the handheld sold more than 100,000 units before production ended.
Reality
Russian authorities restrict mobile service during Ukrainian drone raids to deny the drones cellular navigation. The same outage degrades the Telegram, app and SMS alerting that residents are told to use instead of sirens.
Reality
Jesse Lyu says Rabbit delivered more than 100,000 R1s and has stopped making them. The agent layer now opens on hardware customers already own, and the sites it needs to act on are starting to block agents.
Reality
A dev.to harness guide puts numbers on two ways MCP breaks at scale, 8,000 to 15,000 tokens of tool schema on every prompt and a SQLite session lock duplicate stdio processes cannot share. Its fix moves stateful tools onto a supervised loopback daemon.
Reality
A $52.68 million cliff unlock dated September 22 equals about 83% of a day's trading in GRAM, and the locker behind it has already paid out 12 of its 36 monthly distributions, leaving 24 more to come.
Reality
Meria's Owen Simonin ties a wave of calls impersonating Binance and his own support desk to France's pile-up of data leaks. The state cyber agency was already recording the same script in January, before the DGFiP intrusion.
Reality
Build · September 20, 2026 · 1 publisher
Build · September 19, 2026 · 1 publisher
Build · September 18, 2026 · 1 publisher
Build · September 18, 2026 · 1 publisher
Build · September 17, 2026 · 1 publisher
Build · September 17, 2026 · 1 publisher
Security · September 16, 2026 · 1 publisher
Security · September 16, 2026 · 1 publisher
Security · September 15, 2026 · 1 publisher
Leadership · September 13, 2026 · 1 publisher
Invest · September 11, 2026 · 2 publishers
Invest · September 12, 2026 · 1 publisher
Build · September 12, 2026 · 1 publisher
Build · September 11, 2026 · 1 publisher
Security · September 8, 2026 · 1 publisher
Security · September 10, 2026 · 1 publisher
Build · September 10, 2026 · 1 publisher
Security · September 10, 2026 · 1 publisher
Product · September 8, 2026 · 1 publisher
Security · September 8, 2026 · 1 publisher
Build · September 7, 2026 · 1 publisher
Product · September 6, 2026 · 1 publisher
Security · September 4, 2026 · 1 publisher
Security · September 3, 2026 · 1 publisher
Security · August 31, 2026 · 1 publisher
Invest · August 30, 2026 · 1 publisher
Invest · August 30, 2026 · 1 publisher
Product · August 27, 2026 · 1 publisher
Invest · August 26, 2026 · 1 publisher
Security · August 26, 2026 · 2 publishers
Science · August 26, 2026 · 1 publisher
Security · August 26, 2026 · 1 publisher
Build · August 23, 2026 · 1 publisher
Build · August 23, 2026 · 1 publisher
Build · August 23, 2026 · 1 publisher
Build · August 22, 2026 · 1 publisher
Leadership · August 22, 2026 · 1 publisher
Build · August 20, 2026 · 1 publisher
Invest · August 20, 2026 · 1 publisher
Build · August 19, 2026 · 1 publisher