Attackers published at least eight malicious Python packages on PyPI that target developers building Telegram bots and can give the attackers control of infected servers. The packages are trojanized forks of the Pyrogram Telegram framework and include a hidden backdoor file, secret.py, that registers covert Telegram commands to execute attacker-supplied Python or shell code, read arbitrary files, dump credentials and chats, and exfiltrate output via Telegram. Checkmarx says the campaign, active since November 2025, used multiple package names including pyrogram-styled, pyrogram-navy, VLifeGram, and kelragram.
Why it matters: Developers and organizations running Telegram bots could have had production servers quietly turned into remote-access points for attackers. Anyone who installed the named packages should remove them immediately, rotate credentials and API keys, review bot hosts for persistence, and inspect PyPI dependencies and software bill of materials records.
Bill Toulas
2026.06.30
100% relevant
This article establishes a distinct software supply-chain campaign centered on malicious PyPI packages that backdoor Telegram bot deployments, not a previously tracked package-hijack event.
← Back to all stories