Telegram Bot API sendPhoto exfil of Dahua camera credentials

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•2

Detects outbound HTTP requests to the Telegram Bot API that indicate the exfiltration of sensitive camera credentials or snapshots. The rules identify specific API endpoints such as '/sendPhoto' and the presence of Markdown-formatted text containing 'Login:', 'Password:', and 'Model:' fields within the request body.