Malicious aiosendletter package exfiltrates Telegram Desktop session data

CIRCL describes the 2026-09-aiosendletter campaign, whose packages contain malicious code. During installation, init.py archives the Telegram Desktop tdata directory and uploads it to a hardcoded Cloudflare Workers endpoint. The directory contains Telegram session keys, and uploading it enables full takeover of the installer’s Telegram account.