TWEAKOS steals and sells Telegram and Discord accounts!
It has been discovered that a new malicious program is being used that not only steals user accounts but also allows for the automated management and sale of them.
This malicious program, named TWEAKOS, steals authentication tokens related to Discord accounts from Windows devices, tricks the user into entering a phone number, verification code, and in some cases, two-factor authentication passwords to log into Telegram, creates a new login session for the account, and can send the collected information to cybercriminals.
Most importantly, TWEAKOS is not limited to just stealing accounts. Its second component lists the stolen Telegram and Discord accounts for sale via Telegram, accepts payments from buyers, and automatically sends the purchased account details to them.
This situation shows that cybercriminals are carrying out the entire process, from stealing accounts to selling them, through a single system. Experts emphasize that TWEAKOS allows for the stealing and selling of accounts to be managed through a single Telegram bot.

How was TWEAKOS identified?
TWEAKOS's activity first caught the attention of researchers when its code appeared on the Pastebin platform.
Flare specialists first identified the malicious program component designed for Windows. Later, when searching through the Telegram bot token and operator identifiers within it, a second Python component that used the same information was also found.
As a result, the interdependence between the two components was identified:
- The first component searches for Discord tokens from Windows devices and attempts to obtain a Telegram session;
- The second component manages the stolen information via the Telegram bot, lists victims, and carries out the account selling process.
The fact that both components used the same Telegram bot token and operator identifiers, and the format of the data sent was consistent, indicates that they were created within the same project scope.

However, researchers could not determine how many users TWEAKOS had harmed or exactly how it was delivered to those devices. At the time of analysis, the bot token remained active, and access to the relevant channel was not possible. Therefore, the existence of the code does not imply that it is still active.

What does TWEAKOS do on a Windows device?
When TWEAKOS enters the device, it creates the possibility to resume its activities.
The malicious program can use two mechanisms under the user's account on the Windows system:
- Placing the SystemHelper.exe file in the Startup folder;
- Adding the entry SystemHelper to the Run key in HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
These methods operate within the user's rights and do not require administrator privileges. As a result, the malicious program can continue to run even after the computer is restarted or the user logs back into the system.

What are the Discord accounts targeted?
TWEAKOS checks certain Local Storage LevelDB files related to the Discord application, its PTB version, and the standard profile of the Google Chrome browser.
The goal is to identify authentication tokens related to Discord.
The found tokens are not immediately considered stolen. The malicious program checks their validity via the Discord API. Only active, system-accepted tokens are sent to the cybercriminals. Additionally, account identifiers related to the token are also transmitted.

The important point is that, according to Flare's analysis, TWEAKOS does not search for saved passwords, cookie files, or browser encryption keys in Chrome. Its search within Chrome is mainly aimed at identifying Discord tokens.
This indicates that the malicious program is not a universal stealer that steals any information indiscriminately, but rather a tool targeted at specific types of accounts.

The Danger for Telegram Accounts is Even Greater
TWEAKOS's function related to Telegram is different from simply stealing a file.
The malicious program can ask the user to enter:
- The Telegram phone number;
- The login code sent by the system;
- If necessary, the Telegram cloud password.
Using this information, a new Telegram session is created via the Telethon library.
As a result, the attacker can obtain the .session file related to the victim's Telegram account. This file is an important authentication artifact that allows the attacker to log back into the account and act in the user's name. TWEAKOS sends this session file to the operators' Telegram accounts.

Important Difference: Password is Not Changed
One of the notable points in the TWEAKOS analysis is that the malicious program does not actually change the Telegram password.
Although there is a function to create a value similar to a new password in the code, researchers did not identify the mechanism for replacing the actual Telegram cloud password.
Therefore, the main danger is not the change of the password, but the transfer of the newly authorized session to the attacker.
This is very important: even if the user does not change their password, an active session related to the account might be in the hands of another person.

The Most Dangerous Part: Stolen Accounts are Sold
The main difference between TWEAKOS and other stealers is the existence of an internal marketplace for stolen accounts.
The Telegram bot linked to the malicious program:
- Stores information about victims;
- Lists Telegram and Discord accounts as products;
- Manages buyers;
- Keeps a history of orders;
- Accepts payments;
- Can automatically send the purchased account information.
It is noteworthy that the use of the Telegram Stars payment system in the transaction process is observed. That is, buyers can pay for the account within Telegram itself without going to a separate payment platform.
This shows that cybercriminals are viewing the stolen information not as a simple file, but as a ready-made digital product.

Account Price Decreases Over Time
Another unusual function was identified in TWEAKOS's trading mechanism.
Once the stolen account is listed for sale, its price automatically decreases over time. According to the code, the price decreases by 5% daily, and the total discount can reach up to 70%. The minimum price is set as 1 Telegram Stars.
This mechanism is aimed at selling the stolen accounts before they "age." This is because a newly acquired account may have more value for the attacker, and over time, there is a possibility that the session will be canceled, the password changed, or the account blocked.
Thus, the processes of stealing → storing → valuing → selling → delivering to the buyer are integrated into a single Telegram infrastructure.

Telegram as a Communication Tool to Cybercrime Infrastructure
In the case of TWEAKOS, Telegram performs multiple tasks at once:
- Sending stolen information to operators;
- Managing the malicious program's activities;
- Managing victim information;
- Dealing with buyers;
- Accepting payments;
- Delivering the stolen accounts to the buyer.
This situation is not an isolated incident. Flare's 2026 research noted that Telegram stealer logs and cybercriminal activities are among the widespread environments. According to company data, over 90% of the stealer logs they monitor are found on Telegram.
This suggests that anonymous channels, bots, and offers like "cheap accounts," "ready accounts," or "special services" on Telegram may be linked not only to fraud but also to the trade of stolen data.

TWEAKOS May Also Try to Scare the User
Researchers also identified a VBScript function designed to display a persistent notification window on the victim's computer in the TWEAKOS code.
A script in the form of blocker_{uid}.vbs can display a message about the computer being blocked to the user and repeatedly show a modal window that forces them to close it.
Furthermore, the code also shows the possibility of sending another file named WindowsSecurityChecker.exe. However, Flare researchers could not access this file themselves. Therefore, its actual function has not been confirmed.
Thus, there is not enough evidence to classify this component as ransomware. On the contrary, the existing code shows that it has the ability to scare the victim and force them to execute further malicious payloads.

How TWEAKOS Leaves Traces?
TWEAKOS is not a complex and completely hidden malicious program. According to Flare's analysis, some parts of it also have technical flaws.
For example, the mechanism for writing stolen information into the Telegram bot's database may not work perfectly. There is a possibility that some victims do not appear in the database.
However, these flaws do not prevent the theft and transmission of accounts to the operators. Therefore, searching only TWEAKOS databases is not enough to investigate the incident. Telegram messages from the operators may also be important evidence.

What Should Organizations Pay Attention To?
TWEAKOS also provides an important lesson for government agencies, corporations, and other organizations. This is because one stolen account on an employee's personal device can later be used for social engineering, fraud, or other attacks against the organization.
Experts responsible for information and cybersecurity are advised to check the following:
1. Checking automatic startup points on Windows.
Particular attention should be paid to the following objects:
SystemHelper.exe
;%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
;HKCU\Software\Microsoft\Windows\CurrentVersion\Run
;SystemHelper
Run-key entry.
2. Monitoring suspicious inquiries to Discord and Chrome LevelDB files.
If inquiries to the Discord API are observed after reading the LevelDB files, it is necessary to investigate the incident more deeply. Flare inquired about inquiries to the endpoint discord[.]com/api/v9/users/@me for checking the token.
3. Searching for Telegram session files.
The following naming formats can help identify suspicious activity:
{phone}.session
;session_{uid}.session
.
If outgoing requests to the Telegram Bot API are observed after creating such files, the incident must be investigated.
4. Analyzing Telegram API Traffic.
Requests sent to the api.telegram.org address, such as sendMessage and sendDocument, are not automatically considered malicious because they are part of Telegram's legal infrastructure. However, if this traffic is observed simultaneously with the appearance of new .session files, reading Discord tokens, or the creation of a new startup mechanism on Windows, it may be an important sign to investigate.

Important Recommendations for Ordinary Users
Never enter your Telegram login code into any other application.
If an unknown program running on your computer asks you to enter your Telegram phone number, SMS, login code, or cloud password, treat this as a serious danger sign.
Also:
- Do not download programs or "cracks" from unknown sources;
- Do not run unknown files sent via Telegram;
- Use additional security mechanisms on your Discord account;
- Regularly check active sessions in Telegram;
- Immediately terminate unknown or suspicious sessions;
- If you suspect an account has been accessed from an unfamiliar device, terminate the sessions;
- If you suspect a Discord token has been stolen, revoke it and re-authenticate;
- Enable multi-factor authentication for organizational accounts.

Flare also recommends revoking Telegram sessions, updating stolen Discord tokens, and using multi-factor authentication in the cases where TWEAKOS is identified.

Key IoCs for TWEAKOS
The following indicators can help in identifying TWEAKOS and investigating incidents:
| Type | Indicator | Note |
|---|---|---|
| Domain | api.telegram.org | Can be used to send information via the Telegram Bot API; not considered a malicious indicator independently as it is part of the legal Telegram infrastructure |
| URL | discord[.]com/api/v9/users/@me | Used to check the validity of the Discord token |
| URL | https://discord[.]gg/tweakos | Discord link provided by TWEAKOS; the link was inactive during the investigation |
| File | SystemHelper.exe | File used for automatic startup on Windows |
| Registry | HKCU\Software\Microsoft\Windows\CurrentVersion\Run → SystemHelper | Persistence mechanism at the user level |
| Folder | %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ | Startup folder where SystemHelper.exe may be placed |
| File Example | {phone}.session | File related to Telegram session |
| File Example | session_{uid}.session | Session file that can be stored by the bot |
| File Example | blocker_{uid}.vbs | Script that displays a mandatory warning on the victim's screen |
| File | WindowsSecurityChecker.exe | File considered as a subsequent malicious payload, but researchers could not find the file itself |
| Database | tweakos_data.db | Used to store information about victims, products, buyers, and orders |

Note: IoCs should be used for checking security tools and analyzing incidents. It is not recommended to block legal infrastructure like api.telegram.org based solely on the presence of this indicator. It should be assessed in conjunction with other suspicious activities. Flare also recommends monitoring persistence objects, inquiries to LevelDB, Discord API requests, Telegram API traffic, and .session files when identifying TWEAKOS.

TWEAKOS reflects an important trend in the modern cybercrime ecosystem: stealing information alone is not enough for the attacker—managing the stolen information, using it, and monetizing it are all integrated into a single system.
In this situation, the malicious program on the Windows device identifies Discord tokens, attempts to create a login session for the Telegram account, and sends the collected information to operators via Telegram. The second component then manages the victims, lists accounts as "products," automatically reduces the price, and delivers them to buyers through this infrastructure.

This does not imply that a specific organization or user's device has been compromised by TWEAKOS. However, in this threat example, there is a need for greater caution regarding the protection of Telegram and Discord accounts, especially concerning login codes, sessions, and authentication tokens.

To the respected citizens and information and cybersecurity experts! Do not enter login codes and passwords of Telegram or other messengers into unknown programs, do not run suspicious files, and regularly monitor the active sessions on your accounts. Even a single stolen session or token can allow the attacker to act in the owner's name.