Malware Campaign Employs Telegram as Both Command Infrastructure and Marketplace for Compromised Accounts

Security researchers have uncovered TWEAKOS, a malware operation that not only steals messaging platform accounts but also converts them into products for resale. The campaign combines a Windows-based information stealer with a Telegram-powered management and sales platform, creating a streamlined ecosystem for harvesting and monetizing compromised accounts.

The threat first came to light after its source code was publicly exposed on Pastebin, allowing analysts to examine two interconnected Python components. While researchers were able to reverse engineer the malware's functionality, they have not yet determined how victims are initially infected or the total number of users impacted. Executing the malware can compromise Discord accounts and generate reusable Telegram login sessions that attackers can later exploit.

Researchers at Flare connected the two components through shared Telegram bot credentials and operator accounts. Their analysis revealed that a single Telegram bot serves multiple roles, acting as a theft platform, operator control panel, and marketplace for stolen accounts.

Unlike many credential-stealing malware families that simply harvest and exfiltrate data, TWEAKOS incorporates a built-in commercial model. Stolen Telegram sessions and Discord authentication tokens become ready-to-sell digital assets. A hijacked Telegram session enables attackers to impersonate the account owner, while a valid Discord token can provide immediate access to a victim's account without requiring login credentials.

According to findings shared by Flare with Cyber Security News (CSN), the malware's source code clearly demonstrates both credential-theft and account-trading capabilities, although researchers were unable to verify whether the exposed Telegram infrastructure remains active.

How TWEAKOS Operates

On compromised Windows devices, the malware establishes persistence to ensure it executes whenever the user signs in. The packaged version copies itself into the user's Startup folder, while the script-based variant creates a user-level startup entry. Neither technique requires administrative privileges, making it easier for the malware to survive reboots without triggering elevated permission requests.

Once active, TWEAKOS searches for Discord authentication tokens stored locally by Discord applications, development builds, and Chrome's default browser profile. Any discovered tokens are validated against Discord's services before being forwarded to the threat operators via Telegram. Unlike many information stealers, TWEAKOS does not broadly harvest browser passwords, cookies, or encryption keys. Instead, it focuses specifically on obtaining working Discord tokens that can be immediately abused.

The malware also includes functionality for compromising Telegram accounts, although this portion requires direct interaction from the victim. Users are prompted to enter their phone number, one-time login code, and, when enabled, their Telegram cloud password. The malware then uses the Telethon framework to create a new authenticated session.

If a valid session file is generated, copies are automatically transmitted to operator-controlled Telegram accounts. This allows attackers to reuse the victim's authenticated session without needing to know the actual account password. Researchers noted that while the code can generate a random password string under certain circumstances, it does not modify the victim's existing password. As a result, the primary risk stems from stolen session tokens rather than password resets or account ownership changes.

Telegram as a Cybercrime Marketplace

A second Python component powers the malware's Telegram-based storefront. The bot maintains records of victims, customers, products, and completed transactions through a local database system.

The marketplace advertises stolen Telegram and Discord accounts, accepts payments through Telegram Stars, and automatically delivers purchased credentials after successful payment. To encourage purchases, the platform features a dynamic pricing model that reduces account prices by five percent per day, up to a maximum discount of seventy percent, while maintaining a minimum cost of one Telegram Star.

This direct integration between credential theft and resale distinguishes TWEAKOS from many underground marketplaces, which typically acquire stolen accounts from separate criminal suppliers. In this operation, the malware acts as both the acquisition mechanism and the inventory source.

Beyond sales functions, operators can review victim records, communicate with compromised users, and activate additional features, including a script that repeatedly displays warning messages on a victim's screen. Researchers also identified references to a supposed security-update payload, although they were unable to recover the file or determine its functionality.

Operational Weaknesses and Defensive Guidance