DIQQAT! TWEAKOS Telegram and Discord accounts are stolen and put up for sale!

Reporting by Uzbekistan UZCERT IncidentsRead the original at uzcert.uz

Executive Summary

A malicious program named TWEAKOS was discovered that steals authentication tokens from Discord accounts on Windows devices and facilitates their automated management and sale. The program achieves this by tricking users into providing information, including phone numbers and verification codes, to log into Telegram, thereby creating new login sessions. TWEAKOS uses a second component linked via a Telegram bot to list these stolen accounts for sale and manages transactions, accepting payments possibly through Telegram Stars. Researchers identified two components: one that extracts Discord tokens from Windows system files and another that manages the process via a Telegram bot token and operator identifiers. The analysis indicates that while the program does not change the actual Telegram cloud password, it transfers newly authorized sessions to cybercriminals.

Facts Only

* TWEAKOS steals authentication tokens related to Discord accounts from Windows devices.
* The program collects Telegram phone numbers, verification codes, and potentially two-factor authentication passwords from users.
* A new Telegram session is created using the collected information via the Telethon library.
* The malicious program sends the resulting .session file related to the Telegram account to operators.
* TWEAKOS checks Local Storage LevelDB files, PTB version, and Google Chrome profiles to identify Discord authentication tokens.
* The stolen tokens are checked for validity against the Discord API before transmission.
* TWEAKOS uses two mechanisms to operate on Windows: placing SystemHelper.exe in the Startup folder or adding it to the Run key in HKCU\Software\Microsoft\Windows\CurrentVersion\Run, requiring no administrator privileges.
* The program facilitates the stealing, listing, and selling of accounts via a single Telegram bot system.
* The process involves automatic price reduction for listed accounts by 5% daily, with a total potential discount up to 70%.
* Indicators include files like SystemHelper.exe, Registry keys, and session files named {phone}.session or session{uid}.session.

Full Take

The structure of TWEAKOS reveals an evolution in cybercrime methodology where data exfiltration is merged directly with monetization infrastructure. The core pattern involves linking low-level system compromise (stealing tokens) with high-level communication channels (Telegram bots) to create a turnkey marketplace for illicit assets. The integration of Discord token harvesting and Telegram session management demonstrates a strategic pivot: the initial theft mechanism targets access credentials, but the primary objective is leveraging the ubiquitous nature of messaging platforms for distribution. The automated pricing decay mechanism suggests an attempt to manage perceived scarcity and obsolescence of the stolen goods before they are exploited or invalidated by legitimate account activity. This integrated system moves beyond simple theft; it establishes a self-contained ecosystem where stolen data flows seamlessly into a profit pipeline, mediated through Telegram’s infrastructure. The persistent threat is not just the immediate loss of an account but the creation of an enduring, automated conduit for trafficking compromised credentials across multiple platforms simultaneously. What are the systemic safeguards that rely solely on endpoint security or platform-level terms of service to defend against such integrated, multi-stage attacks? How does the reliance on messaging platforms for commerce inherently change the risk profile for every user who interacts with those systems?

From the original · Uzbekistan UZCERT Incidents

TWEAKOS steals and sells Telegram and Discord accounts! It has been discovered that a new malicious program is being used that not only steals user accounts but also allows for the automated management and sale of them.

Read the full story at uzcert.uz

Sentinel — Human

Confidence

The text reads like a forensic breakdown of a specific cyber threat (TWEAKOS), blending technical indicators with cautionary advice, strongly suggesting human journalistic or analytical authorship rather than pure synthetic generation.

Signals Detected

Sentence length variance is moderately erratic; shifts in focus occur naturally.

The text maintains a consistent, investigative tone focused on forensic evidence, showing human-like narrative progression.

Flow is logical; the argument builds from identification to mechanism to implications without rigid template repetition.

The presentation of technical IoCs and specific steps feels grounded in a real forensic analysis context, though the overarching narrative is highly sensationalized (typical of security reporting).

Human Indicators

Use of specialized terminology (e.g., Telegram bot token, LevelDB, IoC) integrated into a cohesive investigative narrative.

Inclusion of nuanced caveats about the limitations of the findings (e.g., 'TWEAKOS qancha foydalanuvchiga zarar yetkazganini aniqlay olmagan').

The shift between technical dissection and public safety advice suggests an editorial goal beyond pure data relay.