A dangerous zero-day vulnerability in Telegram for Android has emerged as a significant threat to cryptocurrency users who rely on the messaging platform for trading communities, project discussions, and wallet notifications. Security researchers discovered the exploit, dubbed “EvilVideo,” when a threat actor named Ancryno began advertising the flaw on an underground forum on June 6, 2024, marking yet another instance where widely-used communication tools become attack vectors for digital asset theft.
The Exploit Mechanics
The EvilVideo vulnerability targets Telegram for Android, specifically affecting the way the application handles video file rendering. The exploit allows attackers to disguise malicious Android APK payloads as innocuous video files within Telegram chats. When a user encounters what appears to be a video thumbnail, the underlying payload can execute without triggering standard Android installation prompts or security warnings.
This technique represents a significant evolution in social engineering attacks against crypto holders. Telegram has become the de facto communication hub for cryptocurrency communities, with thousands of trading groups, decentralized finance protocols, and NFT projects operating channels on the platform. Users frequently share media files, screenshots of trading setups, and promotional videos, making the disguise of malicious payloads as video content particularly effective.
The zero-day affects Telegram version 10.x for Android, and the vulnerability was actively being sold on underground forums before researchers at ESET identified the advertisement. The exploit bypasses Android built-in security measures by leveraging Telegram media preview functionality, which normally processes video thumbnails without requiring explicit user permission for each file.
Affected Systems
The primary targets include any Android device running the vulnerable Telegram version. Within the cryptocurrency ecosystem, the risk is amplified because many users manage wallets, execute trades, and store sensitive information on the same devices they use for Telegram. Hot wallets, browser-based wallet extensions, and even hardware wallet companion apps on Android devices could all be compromised if a malicious APK establishes persistence on the device.
Crypto traders who participate in Telegram-based signal groups, airdrop channels, and decentralized exchange communities face elevated exposure. These groups frequently share files, links, and media content as part of normal operations, creating an environment where a disguised malicious payload could spread rapidly among thousands of users before detection.
The timing of this vulnerability is particularly concerning given the broader cryptocurrency market context. With Bitcoin trading around $70,757 and Ethereum near $3,811 as of early June 2024, the total value at risk across Android-based crypto users is substantial. The Ethereum ETF approval had just been announced on May 23, driving renewed mainstream interest in digital assets and bringing new users into Telegram crypto communities.
The Mitigation Strategy
Addressing the EvilVideo vulnerability requires a multi-layered approach. Telegram issued a patched version following responsible disclosure, and users should immediately update to the latest version of Telegram for Android. Enabling Android Play Protect provides an additional layer of defense by scanning applications for known malicious behavior before and after installation.
Cryptocurrency users should implement strict device segregation practices. Dedicated devices or isolated user profiles for cryptocurrency operations prevent cross-contamination from messaging applications. Hardware wallets remain the most secure option for storing significant holdings, as they require physical confirmation of transactions and operate independently of the potentially compromised Android environment.
Security researchers recommend that crypto users disable automatic media downloads in Telegram settings, carefully verify the source of any shared files, and avoid interacting with media from unknown senders in large group chats. For project operators, migrating sensitive communications to platforms with more robust file handling security could reduce organizational risk.
Lessons Learned
The EvilVideo zero-day reinforces a critical lesson for the cryptocurrency community: the weakest link in a security chain is often not the blockchain protocol itself but the surrounding infrastructure. Smart contract audits and protocol-level security measures mean little if users access their wallets through compromised devices. The attack surface extends far beyond decentralized finance code to include operating systems, messaging platforms, and browser extensions.
The underground market for zero-day exploits targeting platforms popular with crypto users continues to grow. The fact that Ancryno was openly selling this vulnerability indicates a mature and liquid market for attack capabilities specifically designed to target cryptocurrency holders through their communication tools.
User Action Required
Android users who actively use Telegram for cryptocurrency activities should take immediate steps to protect themselves. Update Telegram to the latest version from the Google Play Store. Review installed applications for any unfamiliar or recently added apps that may have been installed without explicit consent. Consider using a dedicated device or secure profile for all cryptocurrency operations. Enable two-factor authentication on all exchange accounts and wallet services. Move long-term holdings to hardware wallets that are never connected to devices used for messaging or browsing.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research and consult with security professionals regarding your specific situation.
disguising an APK as a video thumbnail is next level social engineering. and you know half the crypto telegram groups have auto-download enabled
0xMidas.eth auto-download is the real killer here. one tap on a thumbnail and your seed phrase is gone. disable that setting yesterday
disguising APK as video thumbnail works because every crypto telegram group auto-downloads media. one tap and your seed phrase is on a server in eastern europe
auto-download should be off by default. the fact that telegram still hasnt changed this setting tells you where their priorities are
null_pointer auto-download is the vector but the real problem is telegram using their own media playback instead of system intents. one custom parser bug away from arbitrary code execution
apk_forensics using a custom media player instead of system intents is such a telegram move. every other comms app delegates to the OS media stack
apk_forensics custom media parser instead of system intents is such a telegram thing. they reinvent every wheel and each one has its own attack surface
disguising APK payloads as video thumbnails is clever social engineering. every crypto group on telegram shares video clips constantly
Tomoko A. disguising APKs as video thumbnails works because every crypto telegram group shares clips constantly. the attack piggybacks on normal user behavior, not exploitation
disguising APK payloads as video thumbnails is next level social engineering. telegram has 900M users and half of them are in crypto groups. this was a ticking time bomb
the android install prompt bypass is the scary part. most users trust anything that looks like media preview. google play protect wouldnt catch a sideloaded payload disguised as a video file
sideload_rat play protect wouldnt catch a sideloaded payload but the bigger issue is telegram bypassing the standard android install dialog entirely. custom media parser was a design choice that created this attack surface
Every trading group I am in uses Telegram. The idea that a fake video could drain my wallet because I tapped a thumbnail is genuinely terrifying.
Ancryno was selling this on a forum for how long before Telegram patched it? if even 0.1 percent of crypto telegram users clicked that fake video thumbnail thats thousands of drained wallets
auto download being on by default in 2024 is genuinely embarrassing for an app with a billion users. one thumbnail tap and your seed phrase is gone
telegram has been a security nightmare for years. this is just the latest in a long line of exploits targeting crypto users on that platform
Ancryno was selling this on a forum meaning anyone with 0.5 BTC could buy it. telegram patches one exploit and ten more are for sale by monday
Ancryno was selling this on a forum which means the exploit already changed hands multiple times. the patch timeline vs active exploitation window is the real concern
The Ancryno actor was selling this on a forum for presumably anyone to buy. That means multiple threat groups may already have this capability.
^ and telegram took how long to patch? these centralized chat apps are a single point of failure for the entire crypto community
ancryno selling this on a forum means 5+ threat groups already had the exploit before telegram even knew. the patch window vs exploitation gap was probably weeks
Lena S is right about multiple groups having this. Ancryno was selling on a forum, not using it exclusively. who knows how many copies are out there
Lena S. ancryno selling on a forum means the exploit is already in the wild across multiple threat groups. telegram patches one channel and ten more open up. move to signal for anything crypto related
Soriya P. signal has like 10 percent of telegrams crypto user base. the network effect is the real vulnerability here, not EvilVideo
Soriya P. moving to Signal is the obvious answer but the network effect is impossible to break. every airdrop, every AMA, every alpha group is on telegram. thats why nobody leaves even when the exploits go public
ancryno was literally advertising this on a forum. the patch window vs active exploitation gap is what makes zero days like EvilVideo so dangerous for crypto users
auto download still on by default in 2024 with a billion users. telegram had years to flip that setting and chose engagement metrics over safety