# TWEAKOS Stealer: Discord Token Theft and Telegram Account-Takeover Marketplace

> TWEAKOS is a two-component Python malware ecosystem uncovered by Flare after its source code leaked on Pastebin: a Windows stealer that harvests Discord authentication tokens and hijacks Telegram accounts via a Telethon-scripted login flow, feeding a same-process Telegram bot that lists, prices, and sells the stolen accounts for Telegram Stars.

- **Published:** 2026-09-27T00:00:00Z
- **Last reviewed:** 2026-09-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2715
- **ID:** TL-2026-2715
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TWEAKOS surfaced on 2026-09-24 when Flare's dark-web/Pastebin monitoring flagged a post containing the Python source of a Windows stealer, along with a hardcoded Telegram bot token and two hardcoded operator (admin) Telegram IDs. Pivoting on that bot token and admin-ID pair across Flare's platform surfaced a second, substantially larger Python component (v2) that reuses the identical credentials -- a long-lived Telegram bot process that functions simultaneously as the malware's command-and-control channel and as a stolen-account storefront, backed by a SQLite database (tweakos_data.db) tracking victims, products, buyers, orders, and operator actions.

The stealer (v1) targets two distinct classes of accounts. For Discord, it scans the Local Storage LevelDB directories (.log/.ldb files) used by the standard Discord client, the Discord PTB/canary build, and Chrome's default profile, applying regex matching -- including a pattern for tokens beginning with "mfa." -- to locate authentication tokens. Each candidate token is validated against the live Discord API endpoint discord.com/api/v9/users/@me; only tokens that return HTTP 200 are exfiltrated, bundled with the associated account's user tag. For Telegram, the stealer uses the Telethon client library to interactively walk a victim through account takeover: it prompts for a phone number, a login code, and -- if enabled -- the account's cloud (two-step) password, inspecting password state via a GetPasswordRequest() call. This produces a fresh, fully authorized Telegram session without ever changing the victim's actual password, which the source code's own comments acknowledge ("the code may generate a new password string when none exists, but it never actually changes the account password"). The resulting {phone}.session file is located on disk and exfiltrated via separate sendMessage/sendDocument calls to the two hardcoded admin Telegram IDs.

Persistence is minimal and user-scoped: the frozen-executable build copies itself to the Startup folder as SystemHelper.exe (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\), while the script-mode build instead writes a SystemHelper value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run -- neither requires administrator privileges. A referenced but unrecovered follow-on payload, WindowsSecurityChecker.exe, is invoked in code with the lure caption "Critical security update. Run it," though its actual functionality could not be confirmed. Operators can also trigger a per-victim blocker_{uid}.vbs script that raises a vbSystemModal Russian-language pop-up ("VASH KOMPYUTER ZABLOKIROVAN!" -- "YOUR COMPUTER IS BLOCKED!") directing the victim to a discord.gg/tweakos invite link, which Flare found invalid/expired during analysis.

The v2 bot backend closes the loop into a functioning criminal marketplace: stolen Telegram and Discord accounts are listed as products priced in Telegram Stars, with an automatic get_current_price() decay function applying a 5%-per-day discount capped at 70% off and floored at a 1-Star minimum -- an explicit acknowledgment that stolen-credential value decays with age. Flare notes this is the first documented case of a stealer and its own storefront operating inside the same bot process and token. However, the researchers also identified a runtime gap: the stealer's exfiltration messages and the bot's product-ingestion handler use different message formats and field-naming conventions, so the recovered code does not by itself prove that every stolen credential reliably becomes a marketplace listing -- some compromised accounts may reach the operators without appearing in tweakos_data.db. No CVE applies (this is credential-theft malware and its associated marketplace infrastructure, not a software vulnerability), no confirmed threat-actor attribution exists, and the initial delivery/infection vector and victim count remain unknown. Whether the exposed Telegram bot backend is still operational was not confirmed by Flare at publication.

## MITRE ATT&CK

- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1555 Credentials from Password Stores
- T1528 Steal Application Access Token
- T1056 Input Capture
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1585 Establish Accounts
- T1587 Develop Capabilities
- T1657 Financial Theft

## Sources

- [TWEAKOS Malware Turns Telegram Into a Stealer, C2 Platform and Stolen Account Marketplace](https://cybersecuritynews.com/tweakos-malware/)
- [TWEAKOS Uncovered: A Telegram-Driven Stealer and C2 Ecosystem for Discord and Telegram Tokens](https://flare.io/learn/resources/blog/tweakos-stealer-telegram-c2-ecosystem-2)
- [TWEAKOS Uncovered: A Telegram-Driven Stealer and C2 Ecosystem for Discord and Telegram Tokens](https://securityboulevard.com/2026/09/tweakos-uncovered-a-telegram-driven-stealer-and-c2-ecosystem-for-discord-and-telegram-tokens/)
- [TWEAKOS Stealer Uses Telegram Bot C2 to Harvest Discord Tokens and Session Data](https://cyberpress.org/tweakos-stealer-harvests-discord-tokens/)
- [TWEAKOS Malware Turns Telegram Into a Stealer, C2 Platform and Stolen Account Marketplace](https://www.cryptika.com/tweakos-malware-turns-telegram-into-a-stealer-c2-platform-and-stolen-account-marketplace/)
- [Telegram: TWEAKOS Malware Turns Telegram Into a Stealer, C2 Platform and Stolen Account Marketplace](https://blog.rankiteo.com/tel1790346347-telegram-cyber-attack-september-2026/)
- [Week 39 - 2026](https://thisweekin4n6.com/2026/09/27/week-39-2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2715