BigBear 2.0 PhaaS Telegram Bot API credential exfiltration

Ankit Mehta@Secvyn

•updated Sep 7, 2026•2•0•3

Detects unauthorized devices or processes attempting to communicate with the Telegram Bot API (/sendMessage or /sendDocument) and monitors for credential-related terms within the request metadata. This often indicates the use of Telegram as a command-and-control (C2) channel for data exfiltration or credential theft.