North Macedonia and the FBI arrested the alleged OLVX administrator, accused of selling stolen data through 1,500-plus seller accounts. The suspect, 20, also ran the ONEMILI Telegram fraud-tools group, police said.
Perspective Coverage
5 publishers
- Builder
- Builder 4%
- Operator
- Operator 86%
- Investor
- Investor 10%
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+10
- Incentives55
- Confidence66
WhatsApp is testing scheduled messages in an Android beta, with a delivery window from 10 minutes to two weeks ahead. Recipients cannot tell a message was held, The Next Web reported, citing WaBetaInfo, in a region where several countries regulate after-hours contact.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence65
buildOne report1 publisher One skipped escape call left Telegram Desktop's HTML export open to stored XSS for 28 months
Telegram patched a stored XSS in Telegram Desktop's HTML chat export in July, after the flaw shipped in stable releases for about 28 months. No CVE or advisory came with the fix, so teams that track exposure by CVE ID had nothing to match against.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+25
- Incentives
- Not scored
- Confidence50
Leaked chats reviewed by Recorded Future News show the Silent Ransom Group directing US-based recruits it calls 'agents' into law firm offices. For firms holding client data, an intrusion can start at reception with someone posing as a courier or an IT worker.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence58
buildOne report1 publisher Telegram Desktop let one clicked link copy a whole account over its local socket
Telegram Desktop patched a flaw, rated CVSS 8.1, that let a single clicked link ship a user's whole account to an attacker's channel. The fix reached hundreds of millions of users in September, described in the changelog as a rendering improvement.
Reality
- Evidence58
- Adoption62
- Hype gap+8
- Incentives55
- Confidence58
Telegram widens Money wallet rollout as GRAM rises 9% to $1.56
Telegram widened access to its non-custodial Money wallet as GRAM rose 9% to $1.56, crypto.news reported. The wallet appears only after a user receives a transfer, so its reach across a billion-user app depends on people who already hold GRAM.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+30
- Incentives65
- Confidence50
Googlebook launches without Adobe's apps or the Linux support ChromeOS had
Google's Android-based Googlebook launched without Adobe's suite or the Linux support ChromeOS had, 9to5Google found in nearly a week of use. For teams buying work laptops, the Android apps it does run were the bigger problem in that testing.
Reality
- Evidence38
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives
- Not scored
- Confidence35
Asos said hackers obtained an employee's login by posing as a trusted contact, then reached customer names and contact details on third-party platforms. The shares fell on the hackers' app alert two days before Asos explained it. For a board, that puts staff checks and disclosure speed inside the same risk.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+10
- Incentives70
- Confidence58
Group-IB traces ASOS's rogue push alert to a renamed gaming-trade Telegram account
Group-IB found the Telegram channel in ASOS's October 6 rogue push alert was opened that day by an account once used for gaming-item trading. Until data surfaces, the Snowflake claim is unproven and the abused messaging platform is the lead to work.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives45
- Confidence50
BlueKit sells account takeover from one dashboard with templates for 97 brands
BlueKit, a phishing-as-a-service kit Malwarebytes has tracked since April, runs lures for 97 brands in 176 variants from one dashboard. Its targets include corporate SSO gateways, Salesforce and GitHub, so buyers with little skill can aim polished lures at work accounts.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+25
- Incentives
- Not scored
- Confidence50
Hackers delivered their Asos extortion demand through the retailer's own app
Hackers used the Asos app on Tuesday to send UK users an extortion demand claiming they had compromised the retailer's Snowflake instance. Because the demand went to shoppers, the attackers decided when Asos had to speak to customers, before it could say what data, if any, was taken.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+5
- Incentives65
- Confidence40
DataSuckers answers ATB's breach denial with samples of allegedly stolen data
DataSuckers demanded $400,000 from ATB, Ukraine's largest grocer, claiming records on 7.9 million customers that the company denies were compromised. The samples it posted on Telegram are the only public evidence against ATB's statement that its data is protected.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+30
- Incentives75
- Confidence45
Belarusian Cyber Partisans spent nearly two years inside a Russian healthcare network, Solar says
Security firm Solar says Belarusian Cyber Partisans were inside an unnamed Russian healthcare network from early 2024 until its discovery in December 2025. That network connects to numerous other providers, and Solar says the foothold gave the intruders a possible route into them.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+10
- Incentives55
- Confidence40
Carbonato worms across unauthenticated Docker hosts to plant a Telegram-run AI agent
ThreatDown says the Carbonato worm breaks into Docker daemons open on port 2375 and installs the open-source Hermes AI agent, then rescans nearby networks every five minutes to spread. An operator drives each infected host over Telegram.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+10
- Incentives35
- Confidence50
CARBONATO, a Docker botnet running since October 2024, hijacks hosts on open port 2375 and steals keys from 14 AI providers to fund its own LLM gateway. ThreatDown found the crew's own container registry exposed, handing defenders 4.3 GB of its toolchain.
Perspective Coverage
3 publishers
- Builder
- Builder 33%
- Operator
- Operator 57%
- Investor
- Investor 10%
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+20
- Incentives35
- Confidence60
Group-IB says the RemControl Android banking trojan reaches bank customers in six countries and the Middle East via Meta ads and fake Google Play pages. Its server address sits in a Telegram dead-drop, so the operator can move infrastructure without a new build.
Perspective Coverage
4 publishers
- Builder
- Builder 34%
- Operator
- Operator 59%
- Investor
- Investor 7%
Reality
- Evidence65
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence65
buildOne report1 publisher Stale OpenClaw bot accounts kept sending hourly Telegram messages after the channel was disabled
OpenClaw's Telegram enabled flag stopped inbound polling while cron-driven sends kept firing hourly through three stale bot accounts, one operator reports. The dashboard showed the channel off, and the sends ended only when the bot tokens left the secrets directory.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence40
buildOne report1 publisher Iranian spyware hides command traffic in per-victim Telegram bots and commercial object storage
NCSC, FBI and AIVD say two Iranian spyware families report to per-victim Telegram bots and exfiltrate through Vultr, Storj and Backblaze B2. Networks already allow those services, so detection has to rely on host behaviour such as new Defender exclusions.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher Audit of a self-hosted OpenClaw agent finds four exposed Docker ports and 1,340 polling turns a week
One developer's audit of a self-hosted OpenClaw agent found four ports Docker opened past ufw and watchdog crons using about 1,340 LLM turns a week. The repairs bind container ports to loopback, and the author now measures agent cost as quota by counting task runs.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence45
77 years, stacked: the 764 sentence that resets what a sextortion report is worth
Kyle Spitze drew the maximum on every count, served consecutively, in a case that reached the FBI through a Discord referral. Escalation paths now feed maximum-penalty prosecutions.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+15
- Incentives60
- Confidence62