By
The Nigerian Communications Commission’s Computer Security Incident Response Team (NCC-CSIRT) has issued a critical advisory urging users to enable two-factor authentication (2FA) on their Telegram accounts to enhance security and prevent unauthorized access. This guidance comes in light of a recent discovery by Ukrainian cybersecurity experts regarding a new attack method that compromises Virtual Private Network (VPN) accounts, subsequently affecting users’ Telegram accounts.
The attack, which utilizes Vidar Malware (Vidar Stealer), targets Telegram session data. If a victim’s account lacks 2FA or a passcode, the malware allows attackers to gain unauthorized access to both personal and corporate Telegram accounts. The threat extends across various operating systems, including iOS, Android, Linux, Mac, and Windows.
According to the advisory, the malware is delivered through a malicious installer posing as “Advanced IP Scanner” software. Upon installation, it infects the system with Vidar Stealer, which then steals Telegram session data. Attackers exploit compromised accounts to steal VPN authentication credentials and certificates. Without the added protection of two-factor authentication, cybercriminals can use this access to infiltrate corporate networks.
Once inside the network, the attackers employ tools such as Netscan, Rclone, Anydesk, and Ngrok to conduct surveillance, remotely access systems, and deploy a Cobalt Strike beacon for further data exfiltration.
The NCC-CSIRT, established to protect the telecom sector from cybersecurity threats, continues to work closely with the national cybersecurity team, ngCERT, to mitigate future risks and safeguard Nigeria’s cyberspace. The Commission encourages users to adopt 2FA and exercise caution by avoiding downloading unknown software to protect themselves and their networks from cyber threats.
