Iran-Linked Hackers Are Using a Telegram Backdoor to Steal Your Passwords

Emily Davis · 2026-09-17

You know that Telegram app you use every day? Turns out, it's not just a messaging platform anymore. It's also a hunting ground for hackers. And a group called Handala Hack—linked to Iran—is using it to break into systems and steal passwords. ### What Exactly Is HEAVYGRAM? HEAVYGRAM is a backdoor that hides inside Telegram. Once it's on your machine, it can do a lot more than just read your chats. According to security researchers, it comes with built-in commands that let attackers: - Run commands remotely (like they're sitting at your keyboard) - Discover your system, network, and running processes - Steal files and even your Telegram session data - Take screenshots without you knowing - Sideload malicious DLLs to stay hidden In plain English: if HEAVYGRAM gets in, your passwords, private messages, and files are basically up for grabs. And because it lives inside Telegram, it can slip past a lot of traditional security tools. ### The Other Tool: CRUDEEXCLUDE Handala Hack isn't just using HEAVYGRAM. They're also deploying a Delphi-based utility called CRUDEEXCLUDE. This tool helps them cover their tracks by excluding certain files or folders from antivirus scans. It's like giving the malware a VIP pass to roam free. Together, these two tools form a nasty combo: one to break in, one to stay invisible. ### Why This Matters for You If you're a journalist, activist, or just someone who cares about privacy, this should make you pause. Telegram is often seen as a secure alternative to other messaging apps. But as this case shows, no platform is immune. The backdoor doesn't exploit a flaw in Telegram itself—it tricks you into installing something that looks legitimate but isn't. > "The line between a messaging app and a malware delivery system is thinner than most people think." – Anonymous security researcher So what can you do? First, don't click on random links or download files from unknown sources, even if they appear to come from a friend. Second, keep your software updated. Third, consider using an antidetect browser if you need to manage multiple online identities—it can add an extra layer of separation between your real self and your digital footprint. ### How Antidetect Browsers Fit In Antidetect browsers are designed to let you control your digital fingerprint. They can help you avoid tracking and reduce the risk of being targeted by groups like Handala Hack. While they're not a silver bullet, they're a smart addition to your privacy toolkit. Especially if you're in a profession that attracts attention. ### Stay Skeptical, Stay Safe The Handala Hack campaign is a reminder that cyber threats are evolving. They're not just after big corporations—they're after anyone with valuable data. And they're using the tools we trust most to get it. So next time you open Telegram, think twice about that file someone sent you. Your passwords might depend on it.