AnalysisPublished 23 Jun 2026

How hackers use PowerShell scripts to steal Telegram accounts | Kaspersky official blog

Source Kaspersky Security Blog

Description

Cybercriminals are using a PowerShell script to hijack Telegram sessions and gain access to users’ accounts without a password or verification codes.

Impact

If successfully executed, the script allows attackers to gain unauthorized access to Telegram accounts by stealing session data, bypassing password and two-factor authentication protections. This can lead to account hijacking, enabling attackers to impersonate users, send spam or scams, and access private communications. However, there is currently no evidence of this script being used in the wild beyond testing, limiting immediate impact.

Defensive guidance

Users should avoid running unknown PowerShell scripts and be cautious with email attachments and downloads from untrusted sources. Regularly monitor Telegram active sessions and immediately terminate any unrecognized sessions via Settings → Devices → Terminate all other sessions. Enable Telegram's two-step verification or passkeys for enhanced account security. Keep operating systems and applications updated and use reputable security software to detect and block malicious scripts. Kaspersky Premium is recommended for additional protection against such threats.

References

kaspersky.com/blog/telegram-no-password-session-stealer/56006/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 23 Jun 2026, 17:51 UTC

References

Community reviews