TWEAKOS Malware Turns Telegram Into a Stealer and C2 Platform
The TWEAKOS malware leverages Telegram to steal Discord tokens and Telegram sessions, operating as a C2 platform and a marketplace for stolen credentials.
A new malware operation dubbed TWEAKOS has emerged, weaponizing the popular messaging platform Telegram to not only steal user credentials but also to serve as a command and control (C2) infrastructure and a marketplace for illicitly obtained account access. The malware specifically targets Windows systems, focusing on harvesting Discord authentication tokens and active Telegram login sessions. Researchers at Flare identified the operation after its source code appeared publicly on Pastebin, linking two Python components through shared bot credentials and operator accounts.
The TWEAKOS stealer operates by establishing persistence on an infected Windows system, typically by copying itself into the user's Startup folder or creating a registry entry. Crucially, these methods do not require administrator privileges, making it easier for the malware to maintain its presence after a system reboot. The malware then targets Discord authentication tokens stored locally by the Discord client and Chrome's default profile. It validates these tokens with Discord's API and transmits any valid ones, along with the associated account identity, to the operators via Telegram.
Beyond Discord, TWEAKOS also attempts to hijack active Telegram sessions. This process requires user interaction, prompting the victim for their phone number and login code, followed by a cloud password if required. Using this information, the malware signs into Telegram via the Telethon library and creates a new session file. If this session file already exists, it is exfiltrated to the operators. While the malware can generate new session passwords, it does not alter the account's primary password, meaning the primary risk is the unauthorized reuse of an active session.
The operation's unique aspect is its integrated Telegram bot, which functions as a central hub for managing victims, selling stolen accounts, and facilitating C2 communication. This bot maintains a local database of victims, buyers, products, and completed orders. It offers stolen Telegram and Discord accounts for sale, accepting payment in Telegram Stars and automatically delivering credentials to buyers. Prices dynamically decrease over time, offering discounts of up to 70%.
While the bot handles sales and operator commands, the stealer component directly sends stolen credentials to operator chats. Researchers noted an imperfect link between the stealer's output and the bot's database, as capitalization differences in Discord tokens could lead to missed entries in the database. Therefore, investigations are recommended to focus on operator chat logs rather than solely relying on the bot's database.
No specific delivery vector for TWEAKOS has been identified by researchers. However, the malware's ability to operate without administrative privileges suggests it could be distributed through social engineering, malicious downloads, or other common infection methods. The coercive warning message displayed on a victim's screen, referencing an invalid invite code for 'tweakos', hints at potential social engineering tactics.
Defenders are advised to monitor for unusual startup entries, unauthorized access to Discord token storage, and unexpected Telegram traffic. Users who suspect compromise should immediately invalidate their Telegram sessions, revoke exposed Discord tokens, and enable multi-factor authentication. Any suspicious requests for login codes or cloud passwords should be treated with extreme caution.