Vidar Stealer Telegram C2 Channel Exfil via API

Ibrahim Saud@tektrix

•updated Jun 17, 2026•1•0•11

Detects processes attempting to exfiltrate data over a Telegram C2 channel by making network connections to api.telegram.org or t.me, excluding legitimate Telegram client binaries and common web browsers. This behavior is characteristic of Vidar Stealer and other Malware-as-a-Service (MaaS) stealers.