Zero Day Initiative (ZDI)

New Capabilities

Relayed the disclosure and closed it after the vendor patched

A single clicked link could empty a Telegram Desktop account. The link slipped hidden commands into the app's local socket, which failed to escape the semicolon separating them. Those commands read files that together unlock the login and sent them to an attacker's chat.

Updated Oct 30