Topic
Telegram Desktop
HEAVYGRAM Spyware Uses Telegram Bots for Command and Control Against Iranian Targets
Malware & Botnets
Stored XSS in Telegram Desktop Allows Silent Data Exfiltration via Chat Export
Vulnerabilities & Exploits
Telegram Desktop HTML Export Flaw Allowed Stealthy JavaScript Injection into Chat History
Vulnerabilities & ExploitsTelegram Desktop Bug Deletes Up to 800 GB of User Data on Windows Due to Spellcheck Library Error
A critical configuration flaw in Telegram Desktop for Windows caused the application to recursively delete the entire contents of the C:\custom directory, resulting in the loss of approximately 800 GB of user data including programs, projects, and personal files. The issue originated in the lib_spellcheck library introduced in version 7.1.0, where an empty working directory path was concatenated with /custom and resolved by Qt into an absolute system path. Instead of locating a dictionary file, the code invoked removeRecursively() on the discovered directory, systematically erasing all accessible files while leaving folder structures intact. The bug affected only Windows builds with the built-in spellchecker enabled and remained in distribution for roughly 66 hours across versions 7.1.0 and 7.1.1. Researchers confirmed the behavior using Process Monitor logs and reported it via ticket #31170, prompting developers to add path validation before the function call and disable dictionary operations on empty paths. The corrected code was released in Telegram Desktop 7.1.2, and users running the vulnerable versions are advised to update immediately. No impact was observed on Linux or macOS platforms.
Telegram Desktop Bug Deletes 800 GB of User Data Due to Spelling Checker Path Error
A Telegram Desktop update introduced a critical flaw that caused the application to recursively delete user folders containing up to 800 GB of data on Windows systems. The root cause traced back to an incorrect path construction for the custom dictionary file used by the lib_spellcheck library when Windows native spell checking was enabled. Due to a misplaced return statement in the code, the working directory path remained empty, leading Qt to interpret the path as the root-level C:\custom folder. The application then invoked QDir::removeRecursively on this directory, removing all accessible files while skipping locked ones. The bug affected releases 7.1.0 and 7.1.1 for approximately 66 hours before being fixed in version 7.1.2. Researchers used Process Monitor to confirm Telegram.exe was directly responsible for the deletion attempts. The incident highlights risks of combining recursive deletion functions with unvalidated path inputs in widely used applications.
Telegram Desktop Adds WEB Proxy to Hide MTProxy Traffic Inside HTTPS and WebSocket Connections
Telegram Desktop has received an initial implementation of a new WEB proxy designed to conceal messenger connections within ordinary HTTPS and WebSocket traffic. The feature makes user activity appear as simple website browsing to network providers while MTProxy continues to operate underneath. Developers inserted more than 3,000 lines of code, including a dedicated WEB-proxy transport, domain configuration options, and interface elements such as “Open browser” and “Waiting for browser.” The mechanism works by opening an embedded web page that establishes a secure WebSocket link to a domain resembling a regular site. Multiple MTProxy connections are multiplexed into a single stream and sent through this channel. On the server side an intermediate node demultiplexes the stream and forwards the individual connections to a standard MTProxy instance without decrypting message content.