Researcher Saifeldin Aziz reported that a specially crafted animated sticker may remotely execute malicious code in Telegram on iPhone devices.

The attack requires neither clicking on the sticker nor following any link to explicitly trigger the vulnerability, according to Aziz.

Exploit mechanism

Aziz said he bypassed Telegram's automated checks by crafting malformed animation data that exploits flaws in the client's animation parsing code.

He did not specify which iOS or Telegram versions are affected, and he did not confirm whether vendors have remediated the issue.

Impact and evidence

There are no public reports of cryptocurrency theft linked to this exploit, and Aziz did not provide demonstrable cases of asset loss.

Independent verification by security researchers or a vendor advisory would be necessary to assess the exploit's real-world prevalence and potential damage.

Technical context

Animated stickers commonly rely on compact vector animation formats, and flaws in client parsers can enable memory corruption or other uncontrolled behavior.

Such parser vulnerabilities can sometimes be leveraged for remote code execution when crafted payloads trigger unexpected parsing paths.

Mitigation and guidance

Device owners should keep Telegram and iOS updated to the latest available releases and avoid opening unusual media attachments from unknown senders.

Security teams should monitor official advisories from Telegram and relevant platform vendors, and apply patches promptly once they are published.

Telegram has not issued a public advisory at the time of reporting, and users should await vendor guidance before drawing further conclusions.