https://hackingpassion.com/tags/session-hijacking/Recent content in Session Hijacking on HackingPassion.com : root@HackingPassion.com-[~]HugoenSun, 11 Oct 2026 13:15:10 +0200https://hackingpassion.com/telegram-desktop-one-click-account-takeover/Sun, 11 Oct 2026 13:15:10 +0200https://hackingpassion.com/telegram-desktop-one-click-account-takeover/<p>One click in a Telegram group sent <strong>3 of a victim&rsquo;s login files</strong> to an attacker. The victim opened no file and typed no password. Versions up to <strong><code>7.2.8</code></strong> did it, and the hole had been there <strong>since 2018</strong>.</p> <p>It starts with an invite. Someone you do not know adds you to a Telegram group, and under Telegram&rsquo;s default settings that needs no agreement from you. Sitting in that group are a few small text files, and you never open them, but they are already on your disk, because <strong>Telegram Desktop downloads files up to <code>8 MiB</code> in a group on its own</strong>, the moment you look at the chat.</p>