Hackers Exploit Pastebin PowerShell Script to Hijack Telegram Sessions

Gbhackers •Mayura Kathir • April 24, 2026

Hackers are experimenting with a new Telegram‑focused session stealer that hides in a Pastebin‑hosted PowerShell script posing as a Windows telemetry update, giving defenders a rare view into how such tools are built and tested. The script does not attempt to grab passwords or browser credentials; instead, it focuses entirely on Telegram’s desktop client data […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PowerShell Script on Pastebin Steals Telegram Session Data Cybersecurity researchers have identified a malicious PowerShell script hosted on Pastebin that targets Telegram users by stealthily stealing session data from both desktop and web clients. This script masquerades as a Windows telemetry update, making it likely to be executed by unsuspecting users. Unlike typical credential stealers, this tool specifically focuses on Telegram session data without attempting to capture passwords or browser credentials. The attack method leverages social engineering tactics to ensure user compliance. The scope of the impact is currently unclear, but it poses a significant risk to Telegram users who may inadvertently run the script. As of now, there are no reports of widespread exploitation, but the potential for targeted attacks remains high. Security professionals are advised to monitor for unusual activity related to Telegram sessions. The script's design provides insights into the development and testing of such malicious tools. 2 sources 52

Extracted Entities

Hackers Exploit Pastebin PowerShell Script to Hijack Telegram Sessions

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (3)

Tools (1)