TWEAKOS Uncovered: A Telegram-Driven Stealer and C2 Ecosystem for Discord and Telegram Tokens
Brief
By Sukant Kumar, Cybersecurity Researcher
Most credential stealers stop at theft, but TWEAKOS keeps going: it steals the account, prices it, discounts it 5% a day until someone buys it, and settles the sale in Telegram Stars, all inside the same Telegram bot that received the stolen data in the first place. Theft, inventory, and checkout run in one process, under one bot token.
This is the first documented case of a stealer and its own storefront running inside the same bot process.