A fake donation app steals the logged in Telegram session

On 13 August 2026 Kaspersky published an analysis of an espionage campaign it attributes to the Armored Likho group, also known as Eagle Werewolf. The campaign was discovered in May 2026, and the bait is an app posing as a donation service for Russian foundations. The app is in reality a dropper, and it plants a new toolkit Kaspersky calls the Still Toolkit. One module, Still Sync, steals Telegram session data and pulls messages and files out of the account. The other, Still Audio, listens for speech in the audio stream, records conversations and sends the recordings on. According to Kaspersky the victims are in Russia and include private individuals, major companies, the public sector, IT firms and educational organisations.

What happens technically

The dropper is written in Rust on the Tauri framework and has a graphical interface built to convince. It first asks for a password, presumably one the attackers handed to the person they want to reach, and then shows a catalogue of things to donate to. The catalogue is real in the sense that its contents are fetched from a server the attackers control. While the user browses it, the next stage is decrypted and started in the background. That is a point worth keeping: the app does exactly what it promises, and that is precisely why nothing feels wrong.

Still Sync then looks for the tdata folder, where Telegram Desktop stores the logged in session. It checks the standard folder, the folder used by the Microsoft Store edition, and if told to, the whole disk. If the files are locked by the running program, it falls back on three methods that abuse a privilege meant for backup: opening the files with the backup flag, reading from a shadow copy, and finally copying with Robocopy in backup mode. The machine is registered with the server using a fingerprint assembled from motherboard and BIOS serial numbers, the processor identifier, the system UUID and the domain name, and the server replies with settings that decide what is to be taken. With the Telegram setting enabled, the tool logs into the account using the stolen session and collects user details, chats, groups, channels and files under 250 megabytes.

Still Audio is built the same way but does something else. It unpacks an audio library from its own file, creates a service with a name that resembles something belonging to the system, and uses a threshold value to decide when the sound contains speech. Recording then starts. The address of the control server sits in an environment variable, and if that server stays unreachable for three days the module fetches a new address from a file in a GitHub repository. The repository is a copy of a popular project, and the address is stored there encrypted with the same algorithm and the same key as older tools from the same group. Kaspersky attributes the campaign to Armored Likho with high confidence, partly on the strength of such reused details.

What this means for you if you have Telegram on a work machine

The campaign targets victims in Russia, and you are probably not among them. The mechanism is still yours, because it applies to any app that keeps you logged in between sessions. The session folder on disk is in practice your password in another form. Whoever reaches that folder is inside your account without knowing the password and without meeting your second factor. That holds for Telegram, and it holds for your browser, your collaboration tool and everything else that lets you straight in each morning.

Our assessment is that this should change two things in your thinking. The first is what you count as a secret on an endpoint: session files belong on the same list as passwords and keys. The second is what has to happen after a machine has been compromised. Changing the password is not enough once the session has been copied out, so sessions have to be revoked at the service, and that has to be done for every service used on that machine. Under NIS2 article 21 this is incident handling, and under ISO/IEC 27001 it is control over what sits on the endpoint. We would also point out that an audio recording from a workplace is a privacy incident in its own right, not only a security breach.

Berigo recommends

• Treat session files on endpoints as secrets on a par with passwords, both in risk assessment and in routines.
• Revoke active sessions in every service used on a compromised machine, rather than only changing passwords.
• Watch for processes that read files using the backup privilege, or that create shadow copies without reason.
• Set a rule for which messaging services may be installed on work machines, and what they may be used for.
• Include the possibility of audio recording in your assessment when an endpoint has been under someone else control.