Researchers Demonstrate Telegram Sticker Flaw With Zero-Click iOS Code Risk

Researchers demonstrated a flaw in Telegram’s sticker feature that could let an attacker execute code on an iOS device without user action, creating a zero-click security risk for crypto users who rely on the app.

The researchers disclosed the issue at a security conference in Tokyo. A zero-click flaw can trigger an attack without the recipient clicking, opening or otherwise interacting with content. The demonstration showed code execution on iOS through Telegram’s sticker feature, but did not establish how broadly the vulnerability affects users.

Telegram disputed the researchers’ assessment of the risk. The disclosure did not state whether a fix is available or how far the issue may reach.

For crypto users, the key concern is that the demonstrated attack did not require a recipient to act on a message. That removes the usual warning moment — such as deciding whether to tap a link or open an attachment — from the scenario described by researchers. The disclosure gave no details about effects on Android or other platforms.