Affected Systems
Python developers using PyPI packages for Telegram bot development. Malicious forks of Pyrogram library active since November 2024. Affects developers who may have installed compromised packages instead of legitimate Pyrogram.
Exploitation Status
Active supply chain campaign ongoing since November 2024. Malicious packages distributed via PyPI. Exploitation occurs upon installation and use of trojanized packages.
Business Impact
Attackers gain arbitrary file read access on compromised developer workstations and production servers running affected Telegram bots. Risk of credential theft, source code exfiltration, and lateral movement. Development pipelines and CI/CD systems may be compromised if malicious packages were integrated into build processes.
Urgency
🟠Within 24 hours
Recommended Actions
- Audit all Python environments for non-standard Pyrogram packages using 'pip list | grep -i pyrogram' and compare against official PyPI package name
- Review PyPI package installation logs and requirements.txt files for typosquatted or suspicious Pyrogram variants installed since November 2024
- Scan developer workstations and bot hosting servers for indicators of file exfiltration or unauthorized file access in system logs
- Implement package verification controls such as pip-audit and hash-pinning in requirements files to prevent malicious package installation
- Rotate credentials and API tokens on any systems where suspicious Pyrogram packages were installed