Worms in Telegram: how cybercriminals hack accounts through network attacks

The Telegram messenger infrastructure is becoming an increasingly attractive target for hackers who use worm propagation techniques to compromise accounts. According to analytical sources, cybercriminals have developed a multi-channel attack scheme that targets users in both the Chinese and English-speaking segments of the internet.

Propagation Mechanism: Fake Software and Infected Repositories

Hacker groups employ well-established social engineering tactics. After gaining access to a victim’s account, they conduct mass distribution of malicious links to contacts. The main vectors of distribution include several components: fake versions of Zoom with embedded malware, infected code repositories hosted on public platforms, and infected versions of popular tools or games.

Network worms spread in this manner have the ability to self-replicate within contact networks, creating a chain reaction of account compromises.

From Hacking to Theft: The Chain of Criminal Activity

The targeted goal of these attacks is not just gaining access but ultimately seizing cryptocurrencies and confidential account information. Cybercriminals demonstrate a high level of adaptability – after each successful theft cycle, they modify attack vectors, improve worm distribution methods, and expand their arsenal of malicious tools.

This ongoing threat development process shows that hackers view Telegram not as an end goal but as a platform to scale their operations for compromising crypto assets.

What Users Need to Know

The activity of such groups underscores the critical importance of caution when downloading software, clicking links in messengers, and granting access to your accounts. Worm distribution through social engineering schemes remains one of the most effective tactics for cybercriminals in 2026.