Cybersecurity specialists have recorded a series of targeted attacks on Telegram users, during which the WebRAT trojan, also known as Salat Stealer, infiltrates victims' devices. Infection occurs through a simple visit to certain messenger channels — without the need to download files or follow suspicious links.
The key hypothesis of the experts: the attackers are exploiting a vulnerability in the mechanism of Telegram's new HTML widgets. This vector is especially dangerous because the attack is disguised as ordinary content viewing, which sharply reduces users' vigilance.
Why WebRAT is dangerous for crypto investors
WebRAT belongs to the class of infostealers — malicious programs aimed at stealing confidential data. At risk are:
— cryptocurrency wallets and seed phrases stored on the device;
— logins and passwords for exchanges and DeFi platforms;
— bank card data and session tokens;
— files with private keys and backups.
For holders of digital assets, such a trojan poses a direct threat: compromise of the device effectively means loss of control over funds. Users who keep keys in notes, in the browser, or in desktop wallets without hardware protection are especially vulnerable.
What users should do
Experts recommend limiting visits to unverified channels, promptly updating the Telegram client, and using hardware wallets to store significant sums. Two-factor authentication and regular scanning of devices with antivirus solutions remain additional protective measures.
Cryptalist analysis: The incident demonstrates that popular messengers are becoming an increasingly attractive attack vector targeting the crypto audience, and social engineering and platform vulnerabilities are blurring the line between "safe" content viewing and compromise of funds. For institutional and retail investors, this is a signal to reconsider the asset storage model in favor of cold wallets and strict digital security hygiene.