Researchers have discovered a new threat dubbed “TWEAKOS,” a malware framework that combines a Windows stealer with a Telegram-based command-and-control (C2) system, also operating as a storefront for illicitly posted stolen messaging accounts. Its components emerged when the source code was leaked on Pastebin. Analysts found two connected Python modules, though it’s still unclear how victims are infected or how widespread the impact is. The app steals session tokens, transforms Telegram into both a control channel and marketplace, and turns compromised identity into digital goods for sale.
How TWEAKOS Operates
Once TWEAKOS lands on a Windows machine, it establishes persistence without needing admin-level privileges. The malware either places a copy of itself into the user’s Startup folder or adds a user-level startup entry depending on whether it’s a packaged or script version.
Its primary target is Discord. The malware hunts for authentication tokens in local storage in Discord itself, its test build, and Chrome’s default profile. After validating the tokens, it forwards working ones to its operators via Telegram. While browser credentials, cookies, or encryption keys aren’t harvested, attackers still gain complete access to accounts via usable tokens.
TWEAKOS also seeks to hijack Telegram identities directly. Using Telethon, it prompts victims for phone numbers, login codes, and whenever necessary, cloud passwords, to generate new session files. Those sessions are then shared with two operator accounts for reuse. Notably, the malware never forces a password reset—its goal is access, not disruption.
The Built-In Telegram Account Store
The operation has a built-in shop that sells stolen Telegram and Discord accounts, handling victims, orders, and buyers via a Telegram bot. It accepts payments in Telegram Stars and offers discounts: prices drop 5% per day, up to 70% off, though the minimum price is one Star.
Owners of this illicit shop receive messages alongside theft, with the ability to view victim profiles, send messages, and even display coercive warnings on the victim’s screen via a script. A portion of the code refers to a supposed “security update” payload, but its actual function remains unrecovered.
Indicators, Risks, and What to Do
Flare analysts warn defenders to monitor for Startup folder manipulation or new registry entries around HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Also watch for attempts to access stored Discord tokens, validate them via the Discord API endpoint /api/v9/users/@me, creation of session files for Telegram, or traffic involving api.telegram.org.
Victims should revoke active Discord tokens, clear Telegram sessions, and enable multifactor authentication. Be especially wary of unexpected prompts for login codes or cloud passwords.
The key indicators of compromise include system files like SystemHelper.exe, registry keys named “SystemHelper,” and database files such as tweakos_data.db. Session file patterns and startup scripts are also red flags. Operators can display a fake warning message using VBS scripts to harass or intimidate victims.
Analysts assessing TWEAKOS note that its bot database doesn’t always match what the operators see: capitalization mismatches may cause discrepancies in theft records. For accurate detection, checking operator chat logs is more reliable than consulting the malware’s local database alone.
As of this reporting, it remains unknown how the malware is delivered to targets or how many systems have been compromised. The exposed source code suggests early-stage activity, but it could evolve fast.
TWEAKOS marks a shift from traditional malware: it integrates theft, control, and resale into one ecosystem, using Telegram as more than a mere weapons channel—it’s the storefront and central nervous system. Organizations need to adapt to this kind of full-stack abuse, where bot infrastructure, marketplaces, and credential theft combine. Watch for new variants, cross-platform pushes, and tighter detection around session tokens and messaging platform APIs. This is a step beyond standard credential theft—it’s a moneymaking economy built into the infections themselves.
