A dangerous zero-day vulnerability in Telegram for Android has emerged as a significant threat to cryptocurrency users who rely on the messaging platform for trading communities, project discussions, and wallet notifications. Security researchers discovered the exploit, dubbed “EvilVideo,” when a threat actor named Ancryno began advertising the flaw on an underground forum on June 6, 2024, marking yet another instance where widely-used communication tools become attack vectors for digital asset theft.
The Exploit Mechanics
The EvilVideo vulnerability targets Telegram for Android, specifically affecting the way the application handles video file rendering. The exploit allows attackers to disguise malicious Android APK payloads as innocuous video files within Telegram chats. When a user encounters what appears to be a video thumbnail, the underlying payload can execute without triggering standard Android installation prompts or security warnings.
This technique represents a significant evolution in social engineering attacks against crypto holders. Telegram has become the de facto communication hub for cryptocurrency communities, with thousands of trading groups, decentralized finance protocols, and NFT projects operating channels on the platform. Users frequently share media files, screenshots of trading setups, and promotional videos, making the disguise of malicious payloads as video content particularly effective.
The zero-day affects Telegram version 10.x for Android, and the vulnerability was actively being sold on underground forums before researchers at ESET identified the advertisement. The exploit bypasses Android built-in security measures by leveraging Telegram media preview functionality, which normally processes video thumbnails without requiring explicit user permission for each file.
Affected Systems
The primary targets include any Android device running the vulnerable Telegram version. Within the cryptocurrency ecosystem, the risk is amplified because many users manage wallets, execute trades, and store sensitive information on the same devices they use for Telegram. Hot wallets, browser-based wallet extensions, and even hardware wallet companion apps on Android devices could all be compromised if a malicious APK establishes persistence on the device.
Crypto traders who participate in Telegram-based signal groups, airdrop channels, and decentralized exchange communities face elevated exposure. These groups frequently share files, links, and media content as part of normal operations, creating an environment where a disguised malicious payload could spread rapidly among thousands of users before detection.
The timing of this vulnerability is particularly concerning given the broader cryptocurrency market context. With Bitcoin trading around $70,757 and Ethereum near $3,811 as of early June 2024, the total value at risk across Android-based crypto users is substantial. The Ethereum ETF approval had just been announced on May 23, driving renewed mainstream interest in digital assets and bringing new users into Telegram crypto communities.
The Mitigation Strategy
Addressing the EvilVideo vulnerability requires a multi-layered approach. Telegram issued a patched version following responsible disclosure, and users should immediately update to the latest version of Telegram for Android. Enabling Android Play Protect provides an additional layer of defense by scanning applications for known malicious behavior before and after installation.
Cryptocurrency users should implement strict device segregation practices. Dedicated devices or isolated user profiles for cryptocurrency operations prevent cross-contamination from messaging applications. Hardware wallets remain the most secure option for storing significant holdings, as they require physical confirmation of transactions and operate independently of the potentially compromised Android environment.
Security researchers recommend that crypto users disable automatic media downloads in Telegram settings, carefully verify the source of any shared files, and avoid interacting with media from unknown senders in large group chats. For project operators, migrating sensitive communications to platforms with more robust file handling security could reduce organizational risk.
Lessons Learned
The EvilVideo zero-day reinforces a critical lesson for the cryptocurrency community: the weakest link in a security chain is often not the blockchain protocol itself but the surrounding infrastructure. Smart contract audits and protocol-level security measures mean little if users access their wallets through compromised devices. The attack surface extends far beyond decentralized finance code to include operating systems, messaging platforms, and browser extensions.
The underground market for zero-day exploits targeting platforms popular with crypto users continues to grow. The fact that Ancryno was openly selling this vulnerability indicates a mature and liquid market for attack capabilities specifically designed to target cryptocurrency holders through their communication tools.
User Action Required
Android users who actively use Telegram for cryptocurrency activities should take immediate steps to protect themselves. Update Telegram to the latest version from the Google Play Store. Review installed applications for any unfamiliar or recently added apps that may have been installed without explicit consent. Consider using a dedicated device or secure profile for all cryptocurrency operations. Enable two-factor authentication on all exchange accounts and wallet services. Move long-term holdings to hardware wallets that are never connected to devices used for messaging or browsing.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research and consult with security professionals regarding your specific situation.
disguising an APK as a video thumbnail is next level social engineering. and you know half the crypto telegram groups have auto-download enabled
auto-download should be off by default. the fact that telegram still hasnt changed this setting tells you where their priorities are
Every trading group I am in uses Telegram. The idea that a fake video could drain my wallet because I tapped a thumbnail is genuinely terrifying.
telegram has been a security nightmare for years. this is just the latest in a long line of exploits targeting crypto users on that platform
The Ancryno actor was selling this on a forum for presumably anyone to buy. That means multiple threat groups may already have this capability.
^ and telegram took how long to patch? these centralized chat apps are a single point of failure for the entire crypto community
Lena S is right about multiple groups having this. Ancryno was selling on a forum, not using it exclusively. who knows how many copies are out there