Back Cybersecuritynews

Malicious ‘Pyronut’ Package Backdoors Telegram Bots With Remote Code Execution

Cybersecuritynews •Tushar Subhra Dutta • March 19, 2026

A malicious Python package named pyronut has been discovered on the Python Package Index (PyPI), targeting developers who build Telegram bots by impersonating the popular pyrogram framework. Rather than relying on typosquatting — where a name resembles a legitimate one — the threat actor copied pyrogram’s entire project description word-for-word, creating what researchers describe as a malicious fork, a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious Pyronut Package Compromises Telegram Bots via RCE A malicious Python package named 'pyronut' has been identified on the Python Package Index (PyPI), posing a significant threat to developers of Telegram bots. This package masquerades as a legitimate alternative to the widely used 'pyrogram' framework, which has approximately 370,000 monthly downloads. By copying the entire project description of pyrogram, the threat actor has created a malicious fork that allows for remote code execution (RCE) on both the Telegram session and the underlying host system. Developers who inadvertently install this package could expose their bots and systems to unauthorized access and control by attackers. The current status of the threat is active, with researchers urging immediate caution among developers using Telegram bot frameworks. No specific CVEs have been reported yet, but the implications of this attack vector are severe. 2 sources 66

Extracted Entities

Malicious ‘Pyronut’ Package Backdoors Telegram Bots With Remote Code Execution

The full story

Extracted Entities

Attack Types (2)

Malware (1)

Platforms (2)

Tools (1)