TELEGRAM DESKTOP ONE CLICK ACCOUNT TAKEOVER

Summary from the TLDR InfoSec newsletter

A single clicked link could clone a Telegram Desktop session on 7.2.8 and earlier, because an unescaped semicolon in tg: link IPC handling let attackers inject a hidden interpret: release helper that uploads local files to any chat (CVE-2026-107181). Attackers staged instruction files through auto-download in a group the victim was added to without consent, then exfiltrated the three tdata files that open on another machine with no SMS code or two-step password when no local passcode is set. Users should update to 7.2.9, set a local passcode, and restrict group adds to My Contacts, since Telegram shipped the fix with no advisory.