Blackforce Data Exfiltration To Telegram API

Tim Peck@timpeck

•updated Dec 12, 2025•4•0•111

Detects outbound network connections from common web server processes to the Telegram API domain (api.telegram.org). This behavior is indicative of the BlackForce phishing kit exfiltrating stolen credentials, as newer versions use a server-side component to relay data to a Telegram channel.