Telegram for PC: BeakSec Finds a Way to Quietly Pull Files Without Confirmation

Security researchers at BeakSec have discovered a vulnerability in Telegram for personal computers that allowed files to be taken from a victim's machine unnoticed. The attacker used a special handler, and the client sent files without any additional confirmation from the user. No dialog box, no warning. Telegram session files and everything else the user has access to are at risk. CNews reports this.

What is known about the vulnerability

Public details are scarce. The original report gives no CVE number, no list of affected versions, no indication of platforms (Windows, macOS, Linux), and no information on whether a fix has been released. It also does not say whether the vulnerability was exploited in real attacks or remained within the scope of the research.

The key detail is stated unambiguously: the confirmation step is missing. Schemes like this typically work because the client receives an external command and processes it on its own. When nothing asks the human between the command and the action, anyone who can deliver that command can read files from the disk. The available data does not make clear whether delivery requires a click on a link or opening a message.

Why session files are more valuable than documents

Telegram Desktop stores local session data in the tdata directory. It has long been a known target for malware: stealers copy the whole folder so they can open the victim's account on another machine without entering a code from an SMS. If the vulnerability allowed arbitrary files to be taken, tdata would have been first on the list.

The local passcode in the desktop client encrypts local data, but far from everyone enables it. The cloud password for two-step verification protects sign-in from a new device, yet a hijacked session raises questions about the protection model. The details depend on what exactly could be extracted.

Beyond sessions, work documents, keys, exports, configurations, and everything else in the user's profile are exposed. For corporate laptops, where the messenger sits next to access to internal systems, this is a separate risk category.

There is precedent. In April 2024, researchers showed that Telegram Desktop on Windows launched some file types, including Python scripts, without a warning. The company added a warning at the time. The pattern repeats: the convenience of handling attachments and links conflicts with protection against running someone else's actions on the computer.

What is confirmed and what is not

• Who found it: BeakSec researchers
• Where: Telegram for personal computers
• Mechanism: a special handler, files sent without confirmation
• Visibility to the user: the action happens unnoticed
• What is at risk: Telegram session files and other data available to the user
• Not disclosed: CVE, versions, platforms, patch status, evidence of exploitation

What to do now

First: update the client to the latest version and check whether a new release with a fix has come out. Since the source contains no official confirmation from Telegram, the patch timeline remains an open question.

Second: open "Settings → Devices" and terminate any unfamiliar sessions. It takes a minute. While you are there, enable the cloud password for two-step verification and the local passcode in the desktop client.

Third: do not open links or files from unknown contacts in the desktop version, and use the web client or the mobile app if necessary. For work machines, it makes sense to keep the messenger under a separate profile without access to sensitive directories.

For security teams: add EDR monitoring for access to the tdata directory by foreign processes and for outbound Telegram traffic to unusual addresses. Until details are published, check the client's behavior rather than specific signatures.