Warning about Scanning QR Codes for Trading Bots

Just a friendly notice after seeing a post on Reddit about a user claiming their account was compromised after trying to log into the 'Trojan' trading bot tool here. I can't confirm that this tool was the source of the compromise, so don't take this advisory to be me saying that. Nonetheless, this post underscores the danger of logging in

Let's say you have Telegram for Desktop (the app) and you're logged in, but you decide to use the browser-based Telegram messenger. That will require you to once again log into Telegram. Now the browser you're logging into is obviously trustworthy (since its an official TG source), but let's say it wasn't...your account would be de facto compromised.

Telegram SSO is not like Google/Twitter/Facebook/GitHub single sign-on where the permissions are scoped so that the app can maybe only see your e-mail address or some other basic account info attached to you. When you log into Telegram elsewhere, you're granting that client / site / etc. full unfettered access to your account.

Also, as it pertains to QR codes - you do not need to be logged in to generate one. The QR codes are what you're supposed to scan from already logged in device. So anybody can generate a QR code. Let's say I install a TG client on my computer (nobody logged in) and I launch the application. First thing it will do is show me the screen asking me to sign in (via phone # or QR code with the QR code displayed already).

All I have to do is rip that QR code and then send it to a user for sign-in and then upon scanning it, their client will have authorized the client that produced the QR code to have access to their Telegram. If that user doesn't have 2FA enabled, then that's all that's needed. They don't even have to present the authorization code that Telegram sends to your phone or (already) authorized TG client.

Thus, it would actually be trivially easy for someone to compromise someone's Telegram account with just a QR code. So be careful.

Here's an article from Kaspersky on it: usa.kaspersky.com/blog/telegram-takeover-contest/27866/