A zero-day vulnerability was discovered by Kaspersky Lab in the Telegram Desktop app that could let hackers pwn your computer to mine for cryptocurrencies like Zcash, Monero, Fantomcoin, and others.
Kaspersky Lab’s security researchers say the zero-day vulnerability can be used to deliver multi-purpose malware to computer users using the Telegram Desktop app, including backdoors and crypto-cash mining software.
The security company also discovered that hackers had actively exploited the vulnerability in the Telegram Desktop app, which is based on the right-to-left override Unicode method, since March last year, but only to mine cryptocurrencies like Fantomcoin, Monero, and Zcash.
Once the zero-day vulnerability was successfully exploited, hackers were able to install a backdoor on your computer using the Telegram API as both a command and control protocol, which means they could gain remote access to your PC.
“We have found several scenarios of this zero-day exploitation that, besides general malware and spyware, was used to deliver mining software,” said Kaspersky Lab’s malware analyst Alexey Firsh in a press release (enclosed below). “Furthermore, we believe there were other ways to abuse this zero-day vulnerability.”
Here’s how to protect your PC against this vulnerability
Kaspersky Labs say they reported the zero-day vulnerability to Telegram, so an update of the desktop app could be out any moment now. Therefore, it is highly recommended that you install the latest Telegram Desktop app from the official website.
At the moment of writing, the zero-day flaw hasn’t been seen in Telegram’s products, but if you’re using an older version or a version that you’ve downloaded from an untrusted source, it could be affected. Of course, you can also use Kaspersky Lab’s products to detect and block these type of vulnerabilities.