TWEAKOS malware has emerged as a new threat by transforming Telegram into a platform for account theft and unauthorized access. This malware combines a Windows-based stealer with a Telegram bot, enabling operators to manage compromised accounts and sell access to them.
Unveiling the TWEAKOS Threat
The source code of TWEAKOS was initially discovered on Pastebin, leading researchers to identify two Python components linked to the malware. Despite this discovery, the method of distribution and the number of affected users remain unknown. The malware poses a risk to Discord accounts and can establish a reusable Telegram login session.
Flare’s analysis connected these components through shared bot credentials, revealing a sophisticated operation that not only steals accounts but also sets up a marketplace for selling them. A stolen Discord token provides unauthorized access, while a Telegram session allows impersonation of the account owner.
Operational Insights and Vulnerabilities
The TWEAKOS stealer is designed to persist on infected Windows systems by either copying itself to the Startup folder or creating a user-level startup entry. This persistence strategy does not require administrative privileges, making the malware resilient to system reboots.
Once active, the stealer searches for Discord authentication tokens stored locally and verifies them before sending valid tokens to the operators via Telegram. Unlike broader browser-stealing malware, TWEAKOS focuses on confirming the functionality of these tokens.
The Telegram Marketplace Connection
A second Python component operates the Telegram bot, maintaining a local database of victims, buyers, and transactions. The marketplace offers discounted Telegram and Discord accounts, with prices dropping daily. This direct connection between theft and commerce is a hallmark of TWEAKOS’s strategy.
Researchers noted discrepancies in the database records and the actual stolen data, suggesting that operators might receive account details without proper recordkeeping. Flare advises checking operator chat logs for a more accurate understanding of stolen data.
To mitigate risks, affected users should invalidate compromised Telegram sessions, revoke Discord tokens, and enable multi-factor authentication. Unusual requests for login codes or passwords should be treated with suspicion.
Indicators of compromise include the use of legitimate Telegram and Discord API endpoints for unauthorized activities, persistence files on Windows systems, and specific patterns in session file names.
For comprehensive threat intelligence integration, security teams are encouraged to leverage platforms like MISP or VirusTotal. This approach can significantly reduce investigation times and enhance response strategies.
