Google Apps Script Telegram Bot API Exfil of Victim Fingerprint Data

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•0

Detects outbound network traffic to the Telegram Bot API where the request body contains keywords associated with cryptocurrency wallet software (e.g., MetaMask, Phantom, Tron). This behavior is indicative of a malicious script, possibly embedded in a Google Docs sidebar or similar web-based application, exfiltrating host/browser information or wallet-related data to an attacker-controlled Telegram bot.