Telegram is introducing a new security mechanism to reduce the damage from stolen accounts. One key fix closes a bug that allowed attackers to gain access by sending phishing links. The scheme worked like this: a victim was prompted to open a site on Telegram’s official domain, then change a word in the URL and follow the modified link. Because the session token could be automatically embedded in the official web version’s URL and remain there for some time, altering the link enabled the attacker to capture that token and hijack the session.

To counter such abuses, Telegram has added a “cooling-off” period for certain profile actions. For example, after logging into an account, a user will not be able to transfer gifts for the next seven days, giving victims time to freeze their accounts via support.

source: kod

Keep an eye on the daily Telegram news from OnlyTG.