The telebot-pro PyPI package contains malicious code that activates upon creating a TeleBot() instance. It copies the Telegram Desktop 'tdata' directory from the user's %APPDATA% path, decrypts the local key using Windows CryptUnprotectData, and base64-encodes it. It recursively enumerates up to 1000 image files (jpg, jpeg, png, gif, bmp) from user directories including Pictures, Desktop, Documents, and Telegram Desktop photos. Host reconnaissance data such as hostname, local IP, and WiFi SSID is also collected. The combined data payload is XOR-obfuscated with a hardcoded key and sent via POST requests to a local HTTP server on 127.0.0.1:48765, which relays it to an attacker Telegram bot via the Telegram API. The local HTTP server acts as an exfiltration relay for other infected processes. This behavior constitutes Telegram session hijacking, bulk private media theft, and unauthorized data exfiltration. The package name is deceptive, imitating the legitimate pyTelegramBotAPI library, but its functionality is malicious and unrelated to Telegram bot operations.

This malicious package compromises user privacy and security by stealing Telegram Desktop session files, enabling potential session hijacking. It also exfiltrates large volumes of private media files and collects sensitive host information including WiFi network details. The attacker gains unauthorized access to private communications and personal data, which can lead to further compromise or identity theft.

No official patch or remediation is indicated for this malicious package. Users should immediately uninstall telebot-pro versions 2.3.7 and 2.3.8 if present. Avoid installing packages from untrusted sources or with suspicious names mimicking legitimate libraries. Verify package authenticity before use. Monitor for unauthorized local HTTP servers and unusual network activity related to 127.0.0.1:48765. Consider scanning systems for presence of this package and related artifacts and remove them promptly.