EvilVideo allows attackers to send payloads that appear as video files in the Telegram app for Android. The exploit is only effective on versions of Telegram for Android prior to the July 11 update
ESET, a global European leader in the cybersecurity market, has identified a zero-day exploit, targeting the Telegram app for Android, which appeared for sale at an unspecified price on an underground forum in June 2024. Using the exploit that ESET has named “EvilVideo,” attackers could share malicious Android payloads via Telegram channels, groups and chats, making them appear as media files.
"We spotted the exploit advertised on an underground forum, where the seller showed screenshots and a video testing the exploit in a public Telegram channel. We were able to identify the channel in question, with the exploit still available. This allowed us to test it directly," explains Lukáš Štefanko, ESET researcher who discovered the Telegram exploit.
Analysis of the exploit conducted by ESET Research revealed that the code operates on Telegram versions 10.14.4 and earlier. This exploit appears to take advantage of the Telegram API, which allows developers to upload specifically crafted media files into chats or channels. The exploit takes advantage of the ability to show an Android payload as a media preview, rather than as a binary attachment. When shared in chat, the malicious payload appears as a 30-second video.
By default, Telegram automatically downloads received media files. Users with this option enabled will automatically download the malicious payload once they open the conversation it was shared in. The automatic download option can be turned off manually: in that case, the payload can still be downloaded by tapping the download button of the shared video.
When the user tries to play the “video”, Telegram displays an error message stating that the video cannot be played and suggests using an external player. However, if the user taps the Open button in the displayed message, they will be prompted to install a malicious app disguised as an external app.
After discovering the EvilVideo vulnerability on June 26, 2024, ESET followed the coordinated disclosure policy and reported it to Telegram, but initially received no response. ESET filed the report again on July 4, and this time, Telegram confirmed that internal investigations into EvilVideo were ongoing. The problem was then resolved with the distribution of version 10.14.5, released on July 11th. The vulnerability affects all versions of Telegram for Android up to 10.14.4, but has been fixed starting from version 10.14.5.
Learn more about EvilVideo, in the blogpost “Cursed tapes: Exploiting the EvilVideo vulnerability in Telegram for Android” on WeLiveSecurity.com. Be sure to follow ESET Research on Twitter (now known as X) for the latest news from ESET Research.
