Kaspersky has published information showing that several Telegram applications on the Google Play app store are malicious and still available to download. These trojan Telegram applications have been downloaded over 60,000 times by a targeted Chinese and Uyghur audience, as it appears the apps were tailored for these groups specifically. Although the fraudulent applications appear visually identical to the official Telegram application, they include additional packages that the original does not contain. Specifically, there are multiple calls to the “com.wsys” library that are attempting to gain access to a user’s contact’s information. This library also runs when connecting to a command-and-control (C2) server to facilitate the transfer of user information such as name and phone number. In addition, the trojan code contains a section called “uploadTextMessageToService” that reads incoming messages and uploads the content to a C2 server. Finally, the app collects files that are sent or received on the user’s account. These trojan Telegram applications are designed to monitor and download the user’s information, including the information of their contacts and conversations. Linked below is a list of IOCs associated with these fraudulent applications.