Malicious PyPI Packages Backdoor Telegram Bot Servers

Python developers have become the latest targets of a supply chain campaign after researchers discovered malicious PyPI packages that secretly backdoor Telegram bot servers. The trojanized packages impersonate legitimate forks of the popular Pyrogram framework and give attackers remote access to compromised systems, allowing them to execute commands, steal sensitive data, and maintain long-term control over infected servers.

Researchers at Checkmarx named the operation Operation Navy Ghost and say the campaign has remained active since November 2025.

Malicious PyPI Packages Target Telegram Bot Developers

According to Checkmarx, the attackers published at least eight malicious PyPI packages between November 2025 and June 2026. Every package masqueraded as a legitimate fork of the Pyrogram framework, a widely used Python library for building Telegram bots and userbots.

Although the original Pyrogram project is no longer maintained, it remains highly popular, generating roughly 350,000 monthly downloads on PyPI and more than 1,400 GitHub forks.

Researchers identified the following malicious packages:

• VLifeGram
• VLife-Gram
• pyrogram-navy
• pyrogram-styled
• pyrogram-zeeb
• kelragram
• sepgram
• pyrogram-kelra

Together, the packages accumulated tens of thousands of downloads before researchers exposed the campaign.

Hidden Backdoor Gives Attackers Remote Control

The malicious PyPI packages contain the legitimate Pyrogram source code, making them appear trustworthy during casual inspection.

However, the attackers inserted an additional file named secret.py inside the framework’s helper modules. Once an infected Telegram bot starts, the hidden component quietly registers secret command handlers without alerting the developer.

Those commands allow the attackers to execute arbitrary Python code or shell commands directly on the compromised server.

For example, the malware lets attackers print environment variables, read sensitive files, execute Linux commands, download databases, access Telegram chats, retrieve bot sessions, and install additional malware.

When command output exceeds Telegram’s message size limit, the malware automatically sends the stolen data back to the attackers as a document attachment.

Backdoor Specifically Targets Production Servers

Checkmarx found that the malware activates only when it detects Telegram bot accounts rather than ordinary Telegram users.

This behavior suggests the threat actor deliberately focused on production servers where bots often have access to databases, cloud services, API keys, credentials, and other valuable infrastructure.

The malware also suppresses error messages and disables logging to reduce the chances of detection while operating silently in the background.

Researchers discovered a hardcoded OWNERS list containing Telegram account IDs that grant exclusive control over infected systems. The same list also prevents the backdoor from activating if the malware runs on the attacker’s own infrastructure.

Researchers Link the Campaign to One Threat Actor

Although the malicious PyPI packages appeared under multiple publisher accounts, Checkmarx believes a single threat actor operated the campaign.

The researchers based their assessment on several shared characteristics, including identical backdoor code, the same Telegram OWNERS list, matching command names, and overlapping attacker infrastructure.

Developers who installed any of the identified packages should remove them immediately, rotate every credential stored on the affected server, revoke all Telegram bot tokens, and perform a full incident response investigation.

Checkmarx has also published indicators of compromise, including the malicious Telegram account IDs and attacker profile URLs, to help organizations identify potential infections and determine whether their infrastructure has been compromised.