Obfuscated code was found in the unofficial Telegram client Nekogram, which secretly sends user phone numbers to the bot '@nekonotificationbot' for users logged into the app, linked to their user ID. The modification for collecting phone numbers exists only in finished APK packages distributed through Google Play, GitHub, and the project's Telegram channel. The change is absent in the source code on GitHub and in the APK package from the F-Droid repository.
The backdoor was present in the Extra.java file. It is presumed that sending began with version Nekogram 11.2.3, initially only for users with Chinese phone numbers, and later for everyone. The program also employed OSINT bots '@tgdb_search_bot' and '@usinfobot' to identify users by their IDs, but their phone numbers were not sent. 
Researchers have prepared a Java hook and bot that allow any user to verify whether their instance of the application is sending phone numbers. 
According to the researchers who identified the issue, the authors of the program could have used the information gathered to create a database for later sale to OSINT bot creators. The obfuscation of the modification and the use of inline requests for data transmission indicate a deliberate concealment of such activity. After the issue was revealed in the project's bug tracking system, the author of Nekogram acknowledged the sending of phone numbers to their bot, without explaining the reasons for this activity, but mentioned that the sent phone numbers were not saved or shared with anyone.
Additionally, a vulnerability in the official Telegram application has been identified. The Zero Day Initiative (ZDI), which offers monetary rewards for reports on unpatched vulnerabilities, published preliminary data on vulnerability ZDI-CAN-30207 in Telegram, which is rated with a critical severity level (9.8 out of 10) and designated as a remote attack that does not require user action. Details are set to be revealed on July 24, giving Telegram developers time to implement a fix for users.
New information has emerged indicating that a vulnerability can be triggered by opening specially crafted animated stickers in Telegram, potentially allowing an attacker to execute code without any user action. It appears that the vulnerability is due to an error in the rlottie library, which handles preview functionality.
Representatives from Telegram stated that they do not consider the identified issue to be a dangerous vulnerability, as all uploaded stickers are verified for servers Telegram, and such verification would prevent a malicious sticker from being shown to users. Following Telegram's statement, the severity of the vulnerability was reduced from 9.8 to 7.0.
Source: opennet.ru
