The cybersecurity landscape continues to evolve rapidly, and one of the most concerning developments is the rise of session-based attacks powered by infostealer malware. A recent campaign analyzed by Flare highlights a sophisticated Telegram session stealer leveraging Pastebin-hosted PowerShell scripts to compromise both desktop and web sessions.
Unlike traditional credential theft, this attack focuses on extracting session data—effectively bypassing authentication mechanisms like passwords and even multi-factor authentication (MFA). This shift marks a critical evolution in attacker strategy, emphasizing persistence and stealth over brute-force access.
Understanding the Threat Landscape
Infostealer malware has become one of the most pervasive threats in modern cybersecurity. These tools are designed to silently harvest sensitive data from infected systems, including:
- Browser-stored credentials
- Session cookies
- Autofill data
- Cryptocurrency wallet access
- System and network information
Once collected, this data is exfiltrated to attacker-controlled infrastructure and often distributed through underground marketplaces or Telegram channels.
What makes session-based theft particularly dangerous is that attackers no longer need login credentials. Session cookies can allow direct access to active accounts, effectively impersonating users without triggering authentication alerts.
Attack Chain Breakdown
The Telegram session stealer campaign follows a multi-stage execution model designed for stealth and efficiency.
1. Initial Delivery via Pastebin
The attack begins with a PowerShell script hosted on Pastebin. This method allows threat actors to:
- Avoid hosting malicious payloads on suspicious domains
- Easily update scripts without redeploying malware
- Leverage trusted platforms to bypass security filters
PowerShell is especially attractive for attackers because it is native to Windows environments and requires no additional installation.
2. Fileless Execution
Once executed, the script operates in a fileless manner—running directly in memory. This significantly reduces the chances of detection by traditional antivirus solutions.
Fileless malware techniques have gained popularity because they:
- Leave minimal forensic traces
- Bypass disk-based security controls
- Utilize legitimate system tools for malicious activity
Research shows that PowerShell-based attacks are particularly effective due to their deep integration with Windows systems.
3. Session and Credential Harvesting
The core objective of the malware is to extract:
- Telegram desktop session data
- Web session cookies
- Browser-stored authentication tokens
This data is often bundled into what are known as “stealer logs,” which can contain dozens of credentials and session artifacts from a single device.
These logs are highly valuable in underground markets, especially when they include access to enterprise systems or financial platforms.
4. Data Exfiltration via Telegram
Telegram plays a central role in this ecosystem. Attackers use Telegram bots and channels to:
- Receive stolen data in real time
- Organize and distribute logs
- Monetize access through private groups
Telegram’s scalability and privacy features make it an ideal platform for cybercriminal operations.
Why Session Hijacking Is More Dangerous Than Credential Theft
Traditional security models focus heavily on protecting usernames and passwords. However, session hijacking bypasses these controls entirely.
Here’s why it’s more dangerous:
- No login required: Attackers reuse active sessions
- MFA bypass: Session tokens remain valid after authentication
- Stealth access: Minimal alerts or suspicious login indicators
- Persistent control: Sessions can remain active for extended periods
In many cases, organizations may not detect the breach until significant damage has already occurred.
The Role of Telegram in Cybercrime Infrastructure
Telegram has evolved into a major hub for cybercriminal activity. From malware distribution to credential marketplaces, it supports a wide range of illicit operations.
Threat actors use Telegram for:
- Selling stolen credentials and session logs
- Hosting malware-as-a-service offerings
- Coordinating attacks through private groups
- Automating exfiltration using bots
The industrialization of infostealer malware has transformed cybercrime into a scalable business model, with developers operating similarly to SaaS providers.
Chronological capture events spanning February 14–19, 2026
| Date | Activity |
|---|---|
| Feb 14, 2026 | First web session captures: no auth key material, no VPS routing. kz_version: “K” client active. |
| Feb 14, 2026 | Authenticated sessions follow: dc3_auth_key present, same key material repeating across consecutive captures, single accountNumber throughout. |
| Feb 16, 2026 | New test session begins; a new capture sequence starts. kz_version: “Z” client active from first capture; VPS routing banner now present in all notifications; collector URL referenced in service start message. |
| Feb 16, 2026 | dc4_auth_key material begins appearing; account1 / dcId: 4: different Telegram Web client state or test account. |
| Feb 16, 2026 | Further sub-session with kz_version: “K” and new dc3_auth_key prefix: third distinct auth key set observed. |
| Feb 16, 2026 | Additional captures with kz_version: “Z”; tgme_sync canRedirect: true frequently associated with authenticated sessions; dc4_auth_key material recurring. |
| Feb 19, 2026 | Both PowerShell variants posted to Pastebin under the observed Pastebin account. |
Detection and Mitigation Strategies
Organizations must adapt their security strategies to address session-based threats. Key measures include:
1. Endpoint Monitoring
Deploy advanced endpoint detection and response (EDR) tools capable of identifying fileless malware and suspicious PowerShell activity.
2. Session Management Controls
- Enforce short session lifetimes
- Implement continuous authentication checks
- Revoke sessions upon anomaly detection
3. Threat Intelligence Integration
Monitoring dark web and Telegram channels can provide early warning of exposed credentials and session data.
4. User Awareness
A significant percentage of infections originate from risky user behavior, such as downloading pirated software or game cheats.
5. Browser Security Hardening
Restrict browser storage of sensitive credentials and use secure vaults instead.
MITRE ATT&CK Mapping
Observed Techniques & Evidence
Mapped adversary behaviors across the attack lifecycle with supporting artifact references
| Tactic | Technique ID | Technique Name | Observed Evidence |
|---|---|---|---|
| Resource Development | T1587 | Develop Capabilities | Telegram bot created; local HTTP collector deployed at RFC-1918 address; two distinct collection tools developed (PowerShell desktop stealer source recovered; web session stealer reconstructed from bot notifications). |
| Execution | T1059.001 | Command and Scripting Interpreter: PowerShell | Both variants of the scripts posted on Pastebin are pure PowerShell with no compiled components; no wrapper or loader observed. |
| Execution | T1204.002 | User Execution: Malicious File | Scripts titled “Windows Telemetry Update” designed for manual victim execution via social engineering; delivery vector not observed (technique inferred from script design and naming). |
| Discovery | T1082 | System Information Discovery | $env:USERNAME, $env:COMPUTERNAME, and public IP via api.ipify[.]org collected in both scripts prior to any exfiltration step. |
| Collection | T1005 | Data from Local System | tdata directory contents targeted at $appdata/Telegram Desktop and $appdata/Telegram Desktop Beta in both script variants. |
| Collection | T1185 | Browser Session Hijacking | Web stealer captures active Telegram Web localStorage session state (dcX_auth_key MTProto authorization keys and account1 session structure); cookies field empty across all captures; browser injection mechanism not confirmed from available artifacts. |
| Collection | T1560.001 | Archive Collected Data: Archive via Utility | Compress-Archive cmdlet creates TEMP\diag.zip from discovered tdata paths before exfiltration. |
| Defense Evasion | T1070.004 | Indicator Removal: File Deletion | Remove-Item $temp -Force deletes diag.zip from disk immediately post-upload in v2. |
| Exfiltration | T1041 T1567 | Exfiltration Over C2 Channel / Exfiltration Over Web Service | diag.zip uploaded via sendDocument to api.telegram.org; web stealer POSTs full JSON session payloads to local HTTP collector; both pathways confirmed in artifacts. |
| Command and Control | T1071.001 T1102 | Application Layer Protocol: Web Protocols / Web Service | Telegram Bot API abused over HTTPS as operator notification and data relay channel — legitimate platform traffic used to avoid bespoke infrastructure; sendDocument and sendMessage confirmed in scripts and bot message history. |
Our Expert Opinion on This Case
The Telegram session stealer campaign represents a clear shift in attacker priorities—from credential theft to session exploitation. This is not just a technical evolution; it’s a strategic one.
By targeting session data, attackers are effectively bypassing years of investment in authentication security, including MFA and password hygiene. This exposes a critical gap in modern security architectures: over-reliance on login-based defenses.
What makes this campaign particularly concerning is its accessibility. The use of Pastebin and PowerShell lowers the barrier to entry, enabling even moderately skilled threat actors to deploy advanced attacks. Combined with Telegram’s distribution capabilities, this creates a highly scalable and resilient threat ecosystem.
In our view, organizations must rethink identity security altogether. Protecting credentials is no longer enough—security teams must focus on session integrity, behavioral monitoring, and real-time threat intelligence.
Additionally, user behavior remains a major weak point. The continued prevalence of infections through pirated software and unofficial tools highlights the need for stronger awareness programs.
Ultimately, this case underscores a fundamental truth: cybersecurity is no longer about keeping attackers out—it’s about detecting and responding to them faster than they can exploit access.
