macOS.Gaslight Telegram Bot API getUpdates C2 Polling Loop

Ibrahim Saud@tektrix

•updated Jun 24, 2026•5•0•3

Detects communication between a macOS host and the Telegram Bot API using the 'getUpdates' method. This behavior is indicative of the 'Gaslight' malware family using Telegram as a command-and-control (C2) channel via polling, typically characterized by repeated HTTP requests to 'api.telegram.org'.