Armored Likho Still Toolkit Steals Telegram Sessions and Records Victims’ Conversations
Brief
A cyber-espionage operation linked to Armored Likho is using a convincing donation app to reach people and organizations in Russia.
Once opened, the fake application quietly installs tools designed to take over Telegram accounts and capture private conversations.
The campaign matters because it combines account access with microphone surveillance.
A compromised person can lose chat histories, files, contacts, and spoken discussions in one incident, creating serious privacy and business risks.
Unlike a conventional steal-and-leave operation, it gives operators a way to watch a target’s communications over time and build a more complete picture of personal or organizational activity.
That persistence can multiply the harm, especially for staff with access to sensitive projects, customer data, or internal decision-making across affected public and private organizations.