Related Threat Clusters

Operation Navy Ghost Targets Telegram Bot Developers with Malicious PyPI Packages
A malware campaign named Operation Navy Ghost has been targeting Python developers creating Telegram bots by distributing trojanized forks of the popular Pyrogram library. Between November 2025 and June 2026, at least…

3 articles · Updated June 30, 2026
Malicious Pyronut Package Compromises Telegram Bots via RCE
A malicious Python package named 'pyronut' has been identified on the Python Package Index (PyPI), posing a significant threat to developers of Telegram bots. This package masquerades as a legitimate alternative to the…

2 articles · Updated March 19, 2026

Recent Intelligence Reports

Checkmarx explains — checkmarx.com · June 30, 2026
Malicious PyPI packages give hackers control of Telegram bot servers — Bleepingcomputer · June 30, 2026
Malicious PyPI packages give hackers control of Telegram bot servers — Bleepingcomputer · June 30, 2026
Malicious ‘Pyronut’ Package Backdoors Telegram Bots With Remote Code Execution — Cybersecuritynews · March 19, 2026
Pyronut Package Backdoors Telegram Bots With RCE — Gbhackers · March 19, 2026

Malware Supply Chain Attack Trojan Operation Navy Ghost CWE-78 - OS Command Injection CWE-798 - Use of Hard-coded Credentials Kelragram Pyrogram-kelra Pyrogram-navy Pyrogram-styled Pyrogram-zeeb Pyronut