telebot-pro

Details

**Severity:** Critical

**Affected versions:** `= 2.3.7`

## Source: kam193 (610b15fa9ed3d59133ac59b1104d43337faddd2ee77eaf21fd238bea6ac4f540)
When using the provided bot class, the code starts a hidden exfiltration thread that collects Telegram session files, pictures and information about the machine, like connected WiFi networks.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-08-telebot-pro


Reasons (based on the campaign):


 - uses-telegram-bot


 - action-hidden-in-lib-usage


 - files-exfiltration


 - target:telegram

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/f94d3c298d2a9658982a99894c2f440906257d14/osv/malicious/pypi/telebot-pro/MAL-2026-13757.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/telebot-pro
- https://github.com/ossf/malicious-packages/blob/f94d3c298d2a9658982a99894c2f440906257d14/osv/malicious/pypi/telebot-pro/MAL-2026-13757.json
- https://github.com/ossf/malicious-packages/blob/06026f151d0406abcf51e273cdbe9620a0487d26/osv/malicious/pypi/telebot-pro/MAL-2026-13757.json
- https://pypi.org/project/telebot-pro/2.3.7
- https://pypi.org/project/telebot-pro/2.3.8
- https://github.com/advisories/GHSA-x78w-5mq6-pmpg

Compromised versions (1)

• = 2.3.7

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.