Skip to content
.ca
Home
Posts
Engagements
Recaps
IOCs
Detections
About
Search posts and IOCs
sign in
Loading…
indicator
url
hxxps://api[.]telegram[.]org/bot7004434365:AAGMJLpdyYvb4CDZLQ47zbh0pRB_CC-Hwro/sendMessage
copy defanged
copy refanged (live)
First seen
2026-05-14
Last seen
2026-05-14
Sightings
1
Posts referencing this indicator
Weaponizing Telegram Bots: How Threat Actors Exfiltrate Credentials
Cofense
Telegram Bot API URL used by WSH RAT to exfiltrate infected host information.
2026-05-13
https://api.telegram.org/bot7004434365:aagmjlpdyyvb4cdzlq47zbh0prb_cc-hwro/sendmessage · URL · cyfar.ca
