# EvilLoader: Unpatched Telegram for Android Vulnerability Disclosed

**URL:** https://discuss.privacyguides.net/t/evilloader-unpatched-telegram-for-android-vulnerability-disclosed/25517
**Category:** General
**Created:** 2025-03-05T19:17:14Z
**Posts:** 7

## Post 1 by @rottenwheel — 2025-03-05T19:17:15Z

> **[EvilLoader: Unpatched Telegram for Android Vulnerability Disclosed](https://www.mobile-hacker.com/2025/03/05/evilloader-unpatched-telegram-for-android-vulnerability-disclosed/)**
>
> A newly disclosed in Telegram for Android, dubbed EvilLoader, allows attackers to disguise malicious APKs as video files, potentially leading to unauthorized malware installations on users' devices.

---

## Post 2 by @rottenwheel — 2025-03-05T19:26:27Z

Check it out [here](https://nitter.net/0x6rss/status/1896921691592503465).

---

## Post 3 by @anon6884803 — 2025-03-05T19:29:10Z

Me: Android malware, sounds exciting.

Me: _Looks under the hood_

> As part of this process, the user will be required to grant permission for the installation of apps from unknown sources, a security setting that is typically disabled by default to prevent unauthorized installations.

Me: …

---

## Post 4 by @ignoramous — 2025-03-06T15:09:45Z

> [@anon6884803](#):
>
> Me: …

tbf, the bug is with how Telegram is fooled into thinking an apk is actually a video. I won’t call it a vulnerability but Telegram explicitly prompts its users to use an _external_ player to play the apk/video. An ominous prompt at that, because folks on Telegram really, _really_ need to see that ~~porn~~ viral video, and will do [whatever it takes](https://www.youtube.com/watch?v=W97hM8eCE5g).

---

## Post 5 by @TinFoilHat — 2025-03-06T16:17:13Z

Telegram has excellent track record, not surprised.

Telegram had a “vuln” that allow people to upload media loaded with malicious code in the metadata and will exceute when user tap on the image. Forgot its 2023 / 2024.

There was another vuln due to code error, also something deal with executable disguised as media files.

---

## Post 6 by @anon6884803 — 2025-03-06T16:36:16Z

Of course it is just Telegram having intentionally or unintentionally shitty code for a “secure” messenger. But if I click on a video and get a “Allow installation from unknown sources” prompt, I would probably recheck the file too.

---

## Post 7 by @Anon — 2025-03-07T07:07:09Z

hilarious :rofl: