Back Gbhackers

Pyronut Package Backdoors Telegram Bots With RCE

Gbhackers •Mayura Kathir • March 19, 2026

Malicious ‘Pyronut’ is a trojanized Python package that backdoors Telegram bots and userbots, giving attackers remote code execution over both the Telegram session and the underlying host system. The malicious package , pyronut , was uploaded to PyPI as a fake alternative to pyrogram, a widely used Telegram MTProto API framework with around 370,000 monthly downloads. Instead of […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious Pyronut Package Compromises Telegram Bots via RCE A malicious Python package named 'pyronut' has been identified on the Python Package Index (PyPI), posing a significant threat to developers of Telegram bots. This package masquerades as a legitimate alternative to the widely used 'pyrogram' framework, which has approximately 370,000 monthly downloads. By copying the entire project description of pyrogram, the threat actor has created a malicious fork that allows for remote code execution (RCE) on both the Telegram session and the underlying host system. Developers who inadvertently install this package could expose their bots and systems to unauthorized access and control by attackers. The current status of the threat is active, with researchers urging immediate caution among developers using Telegram bot frameworks. No specific CVEs have been reported yet, but the implications of this attack vector are severe. 2 sources 66

Extracted Entities

Pyronut Package Backdoors Telegram Bots With RCE

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (3)