Do Son 
CYFIRMA researchers have revealed a new .NET-based information stealer called PupkinStealer, a lightweight but highly targeted malware that harvests browser credentials, messaging session data, and sensitive desktop files before quietly transmitting them via the Telegram Bot API. First observed in April 2025, this malware reflects a growing trend in the use of legitimate cloud services for malicious exfiltration.
Unlike bulkier stealers that gather every bit of data they can find, PupkinStealer maintains a clear focusβstealing:
- Browser passwords from Chromium-based browsers (Chrome, Edge, Opera, Vivaldi)
- Session files from Telegram and Discord
- Common file formats from the victimβs desktop (.pdf, .txt, .jpg, etc.)
- A screenshot of the desktop
These items are archived, tagged with system metadata (like username and IP), and sent directly to an attacker-controlled Telegram bot.
βAll collected data is then compressed into a ZIP archive and exfiltrated to a remote server via the Telegram Bot API, minimizing traceability and enhancing stealth,β CYFIRMA reports.
PupkinStealerβs ability to bypass login credentials is particularly concerning. It targets:
- Telegramβs tdata folder: allowing attackers to fully restore the session without needing user credentials.
- Discordβs leveldb storage: extracting OAuth, MFA, and session tokens using regex patterns.
βBy stealing the entire tdata directory, the malware enables an attacker to potentially restore the victimβs Telegram session on another system, gaining full access,β CYFIRMA warns.
The malware uses two key components:
- FunctionsForStealer: to extract browser-specific encrypted keys from the Local State file.
- FunctionsForDecrypt: to decrypt saved passwords using AES-GCM.
βThese decryption keys are then used to access and decrypt the stored passwords from the browserβs Login Data SQLite database,β the report notes.
Each major Chromium browser is handled individually with tailored methods like GetKeyChrome() or GetKeyVivaldi().
PupkinStealer silently:
- Captures the victimβs primary screen at 1920Γ1080 resolution.
- Scans the desktop for high-value files like .sql, .jpg, .png, etc.
- Avoids alerting the user by suppressing error messages during file collection.
Once all data is collected, PupkinStealer:
- Compresses it into a ZIP archive named [Username]@ardent.zip.
- Embeds metadata in the archive comment section (e.g., victimβs IP, SID).
- Sends it using a custom Telegram Bot URL.
Telegram usage for exfiltration has grown popular due to its encryption, reliability, and anonymityβbenefits that threat actors are now fully exploiting.
The malware author is believed to use the alias Ardent, as embedded strings suggest. The Telegram bot used, botkanalchik_bot, appears to have Russian origins, referencing “ΠΊΠ°Π½Π°Π»” (channel).
Related Posts:
- Malicious npm Packages Backdoor Telegram Bot Developers
- Following Russian, Iran also issued a signal to ban Telegram
- New Golang Backdoor Employs Telegram for Command and Control
- Russia immediately blocked Telegram Instant Messaging software
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
