High-Risk Zero-Click Flaw Found in Telegram Stickers, Posing Stealth Threat to iOS Users

A recent security conference in Tokyo unveiled a disturbing discovery. Researchers demonstrated that the popular messaging app Telegram harbors a dangerous "zero-click" vulnerability within its sticker feature.

The Stealthy Nature of Zero-Click Exploits

Unlike conventional attacks that require user interaction, such as clicking a link, zero-click exploits are particularly insidious. They require no action from the victim. An attacker can send a specially crafted message—in this case, a malicious sticker—to trigger the flaw and execute code silently in the background. Even the most vigilant user can be compromised without warning.

Impact and Potential Consequences

The demonstration showed the vulnerability primarily affects Telegram users on iOS. Successful exploitation could allow an attacker to:

  • Execute arbitrary code remotely, gaining a degree of control over the device.
  • Potentially access sensitive data like chat history or contacts.
  • Install a persistent backdoor for surveillance or further attacks.

The highly covert nature of such an attack makes it extremely difficult to detect, posing a significant risk to both personal privacy and enterprise security.

Telegram's Stance and User Recommendations

Telegram responded swiftly to the researchers' findings but contested the severity of the risk. A company spokesperson stated they are monitoring the reports closely and believe the actual exploitation conditions are more restrictive than described. However, the security community widely regards any zero-click vulnerability as a critical priority.

No widespread attacks exploiting this specific flaw have been publicly reported yet. Security experts strongly recommend users take the following precautions:

  • Ensure the Telegram app is updated to the latest version.
  • Keep the iOS operating system current with the latest security patches.
  • Remain cautious of stickers or messages from unknown sources, though vigilance has limited effect against such attacks.

This incident serves as another reminder that even mundane features in everyday apps can become weak links in the security chain. As attack techniques evolve, zero-click vulnerabilities are becoming weapons of choice for sophisticated threat actors, demanding higher security standards from developers and prompt updates from users.