Telegram Is Still Working on Restoring the t.me Domain

UPD July 14, 13:00 UTC: The domain was restored.

The t.me domain is still down for users worldwide, as it was disabled by the administration of the .me domain zone. The messenger's team has not commented on the matter.

As a temporary measure, users are advised to replace t.me links with telegram.me or telegram.dog — the messenger's official domains.

The @tginfo editors note that Instagram blocks links to telegram.me in profiles, but links to telegram.dog work. Some users report that Instagram bans users from using the “link in bio” feature if the domain is changed, so the best course of action is to wait for the t.me domain to be restored.

Shortly after the news about the domain being disabled, Telegram began replacing t.me links in Telegram apps and on the official telegram.org website. Pavel Durov attempted to contact the .me registry administration via their official Twitter account.

Possible reason for the block

The .me zone belongs to Montenegro, and the infrastructure is managed by a joint venture of Identity Digital, GoDaddy, and the local company ME-net.

The owner of the TeleLakel channel received a response from Identity Digital's support team, which claims that the domain was disabled due to the “need to comply with OFAC-related requirements”.

OFAC is a division of the US Department of the Treasury that administers and enforces economic and trade sanctions.

OFAC has not added Telegram to its sanctions lists. However, an action statement dated July 13, 2026, regarding newly sanctioned companies mentions a service called "FIRST VPN SERVICE". Users noticed that one of the links to its website is a Telegram channel address on the t.me domain.

This could mean that the .me domain operator saw the t.me domain in the sanctions lists and quickly blocked it without further research.

The @tginfo team noticed that this morning the messenger deleted the Telegram channel that was mentioned in this sanctions list. It is unknown whether this channel was actually the reason for the block, or if Telegram did this on their own as a precaution.

A popular rumor about the reason for the block

A version is spreading in the community that the t.me domain was revoked because the official Telegram Twitter account joked about the September 11th terrorist attack.

The @tginfo editors consider this version unlikely: if it were true, the .me domain zone administration would likely have blocked all Telegram domains, including telegram.me. Furthermore, the published image was not a joke invented by the company itself, but one of the most popular entries submitted by users as part of a contest.

#outages #bans

The t.me Domain Has Been Restored by the .me Registry

Checks by the @tginfo editors show that the .me zone's main server has returned the DNS records for the t.me domain.

Since DNS records are cached at the level of various DNS services and providers, it may take up to 24 hours for service to be restored on users' devices.

#outages #bans

Exclusive Access to New Bot API Hosting

Using the official @ContestBot, the messenger team is sending service notifications to some winners of past Telegram contests.

People who distinguished themselves in the contests are invited to join a private test of a new Bot API paradigm — Telegram Serverless. It will allow developers to launch and maintain Telegram bots and Mini Apps on Telegram servers, without deploying their own infrastructure.

“As a winner of a previous Telegram competition, you are invited to exclusively test Telegram's new Bot API. It allows you to run your bots — including their code and databases — directly on Telegram's infrastructure, without using your own servers”, says the service message.

Unusually, the invites are sent not only to developers who participated in software development contests, but also to winners in creative competitions.

You can learn more about Telegram Serverless and explore the docs on the official website. Keep in mind that the new API is currently not available to the general public.

#BotAPI

The .me registry commented on the suspension of the t.me domain

A representative of the .me domain zone administration commented on Twitter about the situation regarding the ban of the t.me domain, which belongs to Telegram:

The .ME Registry works closely with law enforcement to monitor and mitigate issues across the .ME domain in accordance with applicable laws, including sanctions requirements.

On 13 July, First VPN Service (1VPNS) was included as a sanctioned entity by the U.S. Department of the Treasury. A Telegram channel using the t.me domain was among 1VPNS identified infrastructure. Accordingly, the t.me domain was suspended.

On 14 July, Telegram provided confirmation that it had removed its links and affiliations with 1VPNS. Once the confirmation was reviewed and verified, the suspension was removed from the t.me domain.

We appreciate Telegram’s prompt cooperation in resolving this matter.

It is unclear from the comment whether the .me administration evaluated the appropriateness of blocking the entire domain of a major social platform and whether the registry will resort to such methods in the future.

As a reminder, on July 13, the .me registry disabled the DNS records for the t.me domain without any public statements from the zone administration or Telegram. On July 14, Identity Digital support explained the ban as compliance with OFAC requirements, and a link to a Telegram channel was found in the service's sanctions lists, which the messenger soon deleted, after which the domain was restored.

The .me zone is allocated to the government of Montenegro, but on its behalf, the infrastructure is managed by a joint venture between Identity Digital, GoDaddy, and the local company ME-net.

#outages #bans

The Australian Internet Safety Regulator Sues Telegram

The regulator claims the service is ignoring the country's laws, citing the messenger's lack of action in deleting terrorist propaganda materials. The government doesn't intend to ban Telegram yet, although it has the power to do so.

The Australian government's demands stem from user reports claiming that videos are being spread on Telegram featuring the Christchurch mosque shootings in New Zealand in 2019 and shootings in a US supermarket in 2022.

"We have alleged that Telegram has failed to detect, deter and disrupt pro-terror material", eSafety commissioner Julie Inman Grant said.

The court case is the result of a year-long investigation. eSafety claims that it attempted to engage with Telegram, but the messenger did not act or answer government requests for five months. Australian law does not require a license to operate in the country, but the regulator may ask the court to ban it.

"We've never used those powers, and we'll see how this all plays out and whether that kind of action is warranted", Ms Inman Grant said.

Telegram's representatives state that “extensive anti-terrorism efforts are well documented”, and its published records claim thousands of “terrorist communities” were removed. The spokesperson added that the company will contest the allegations in court.

More Context

• In November 2025 Telegram initiated a legal battle with eSafety over the “Online Safety Act 2021”, deeming it illegal.

• In February 2025, the Australian regulator fined Telegram over $600,000 for delaying the provision of information on its measures to combat terrorism and materials related to child exploitation.

• The company asserts that once it became aware of the request, it voluntarily provided the required information. The @tginfo team previously analyzed the details of that response, which reveals a lot of details about how Telegram's moderation works.

#Australia #courts

Telegram Is Working on Experimental WEB-Proxy

A new experimental proxy type titled “WEB” was found in Telegram Desktop's code. The discovery was publicized by teleLakel.

The server code for the WEB-proxy is still under development, and Telegram hasn't endorsed any implementations yet, so there is no good way to try the technology at the moment.

Why is this necessary, and why not just use MTProxy?

The already existing MTProxy can also mask to appear as HTTPS traffic using the FakeTLS extension. However, modern Deep Packet Inspection systems (DPI) can already tell such connections apart, since FakeTLS still has some differences from real HTTPS traffic that can be seen from the outside.

The new WEB transport makes detection much harder: to talk to the server, the messenger uses the built-in browser (WebView). It establishes a real TLS/HTTPS connection using standard browser cryptography, which makes Telegram traffic less different from regular web surfing.

How does it work

• The messenger opens a special page on the proxy server domain using a hidden browser
• This domain can also continue to work as a regular website. The hidden Telegram channel only activates if the request contains the correct secret key.
• Inside the unitary web channel, the encrypted MTProxy traffic is enveloped into WEB-proxy frames and sent to the proxy server. Currently, this is done using WebSocket.
• HTTP/WebSocket traffic is repackaged and relayed to the MTProxy server without being decrypted.

Currently, the feature is under active development, so by the time it gets released, the protocol may change.

The independent Telemt community is working on detection-resistant protocols. Earlier, thanks to the community's research into Russian DPIs, Telegram developers updated the MTProxy in their clients to adapt them to new detection methods.

The community notes that the messenger should spend more time developing new censorship-resistance methods. If the messenger doesn't keep improving the new WEB proxy, it might stop working in the future — typical Telegram traffic may have uniquely identifying properties even inside a real TLS connection if additional masking methods are not used on it.

#Desktop #proxy #bans

Telegram Desktop updated to version 7.1.1

What's new:
• Added welcome messages for groups and channels.
• Added buttons and files in articles.
• Improved lists, tables, and Markdown text pasting in the article editor.
• Added self-destruct timers and view-once feature for photos and videos.
• Added video profile picture upload for users, chats, and channels.
• Added a video editor with the ability to trim and crop the clip, change its quality, and set a cover.
• Added the ability to restore open windows and chats upon restart.
• Added new keyboard shortcuts to restore closed windows (Ctrl + Shift + T), as well as to open the article editor (can be assigned in Settings › Chat Settings › Keyboard shortcuts).
• Added the ability to send music files via the attachment menu.
• Added a new proxy type called WEB in the Connection settings.
• Fixed bugs that caused crashes.

Download:
• Windows/macOS/Linux: official website or GitHub 
• Windows: Microsoft Store 
• macOS: App Store 
• Linux: Flathub, Snapcraft

#update #Desktop

Improvements to Video Messaging on Android

In the beta version of Telegram for Android for the upcoming 12.10.4 update, a new section called "Round Video (Experimental)" has been added to the settings.

That page includes several experimental features that allow you to set the focus and smoothness of video messages recorded using the modern Camera2 API:

• Output resolution: 360p / 480p.
• Camera resolution: Low / Medium / High.
• Frame rate: 30 FPS / 60 FPS.
• Video bitrate: 750 kbps / 1 Mbps / 1.5 Mbps / 2 Mbps.

⚠️ Please note: Telegram notes that 60 FPS is used only if both the front and back cameras on the device support this frame rate. Otherwise, recording automatically switches to 30 frames per second.

In addition, users can disable the app's custom styling for downloaded video messages. In that case, the recorded "circle" will be saved to the device as an uncropped square, without any blurring or darkening around the borders and without the Telegram logo.

⚠️ Please note: This option does not alter the appearance of video messages that are sent to chats; the "circles" within the messenger remain circular regardless of whether you have disabled their stylization during the download process.

UPD: The messenger remembers the user's last selection and starts recording the next video message using the same camera that was used to record the previous video. This avoids the need to constantly switch between the front camera and the back camera when you start taking new "circles."

This settings section probably won't be in stable versions of Telegram. It will only be in the beta version while the features are being tested.

Subscribe to our second channel @BetaInfo to be the first to know about upcoming Telegram updates.

#Android #Beta

Wallet bot renamed as Walt — and disappears from the app menu as Telegram prepares its own replacement

On September 28, 2026, users noticed that Telegram had stopped promoting Wallet. The bot itself had been renamed Walt and given a new logo that no longer made it look like an official Telegram service.

In 2023, Telegram and the TON Foundation publicly announced a partnership, and the Wallet bot was closely integrated into the messaging app. In particular, Telegram began displaying the wallet in the app’s menu, promoting it to all its users.

The Wallet bot was launched in 2022 by a company associated with the TON Foundation. At the time, the @tginfo editors expressed the view that Wallet was being developed in close cooperation with Telegram. Today, the company that owns the Wallet bot is known as TOP (The Open Platform).

The @tginfo editors link these changes to the Telegram team’s preparations to launch its own Gram Wallet, which will become the primary wallet for Telegram users.


The history of Telegram Open Network (TON) and Gram

In the view of the @tginfo editors, the TON Foundation and the Wallet bot, now known as Walt, are the result of a hybrid strategy Telegram pursued because of the SEC’s 2020 ban on developing TON.

Telegram is now replacing the bot with the fully integrated Gram wallet, in line with the original 2019 vision. Telegram may have decided to take back direct control of the blockchain thanks to the significant deregulation of cryptocurrencies in the US in recent years.

Preparations for launch and investment

The first rumors about the Telegram Open Network (TON) blockchain and its cryptocurrency, Gram, both developed by the Telegram team, surfaced in 2017.

In 2018, Telegram held a private ICO and raised about $2 billion. At the time, some believed that Telegram was developing TON in part to hold an ICO and raise funds to keep the company going, while avoiding the obligations associated with issuing securities and the need to introduce advertising and paid subscriptions in the app.

By early 2019, it had become clear that the cryptocurrency was being prepared for launch and integration with Telegram in the coming months, in line with previously leaked plans. That same year, an experimental built-in Gram wallet appeared in the app.

The SEC lawsuit and the freeze

In October 2019, the US Securities and Exchange Commission (SEC) sued Telegram, alleging that Telegram was selling securities, not virtual currency, through its ICO. In 2020, Telegram signed a settlement that forced it to refund investors and officially discontinue work on TON. Telegram froze development and removed most mentions of TON and Gram from the app.

After losing the investments raised through the ICO, Telegram began financing itself through Eurobonds and other types of bonds. Telegram did not repay its first debt tranche, issued in 2021, until 2026.

After Durov’s team left, the developer community split into two parallel branches:

• Free TON: An independent group led by TON Labs, a validator, launched a separate network with the TON Crystal token.
• NewTON (TON Community): Another group of independent developers continued supporting the original testnet2 network created by Durov’s team and focused on preserving TON’s original architecture and concept.

The birth of the TON Foundation and the hybrid era

In August 2021, Telegram officially chose the NewTON team, handing over the official ton.org domain and the project’s GitHub repository to it. The NewTON team then renamed itself The Open Network (TON Foundation), and the native token was named Toncoin.

Although Telegram and the TON Foundation were independent, the @tginfo team believes there was an informal connection between them that allowed Telegram to continue working on TON. By maintaining formal independence, Telegram may have been trying to avoid scrutiny from the SEC and other regulators.

In 2022, former VKontakte executive Andrey Rogozov, who had worked with Durov for a long time, and other developers joined the TON Foundation. In 2023, Rogozov also became head of The Open Platform (TOP). A press release states that TOP was formed by merging First Stage Labs with the Wallet team inside Telegram.

Before 2024, the makeup of the TON Foundation team changed quietly, and it appears that at some point Rogozov stopped actively participating in the foundation and focused on The Open Platform. Meanwhile, Telegram maintained closer ties with TOP than with the TON Foundation.

Telegram began a cautious integration: it launched TON-based auctions on the Fragment platform, introduced payouts in TON, enabled gifts to be registered as NFTs, added support for TON Sites to the app, and required Mini Apps to use TON.

It was in this context that Wallet appeared. In the view of the @tginfo editors, it may have been one of the main drivers behind the emergence of the Web Bots / Mini Apps platform in 2022. In 2023, it began appearing for all Telegram users as the default wallet app. Legally, however, it was operated not by Telegram but by the TON Foundation and, later, Rogozov’s TOP.

MTONGA

In spring 2026, Pavel Durov announced the launch of the Make TON Great Again (MTONGA) initiative — a sweeping seven-step program intended to bring TON back to Telegram, transforming it once again from a standalone cryptocurrency project into Telegram’s native blockchain.

Telegram regained control of the blockchain and its status as lead validator, upgraded the blockchain, restored the cryptocurrency’s original name, Gram, and announced plans to integrate a native wallet into Telegram apps. However, it appears that Rogozov’s team’s Walt wallet is not part of the MTONGA plans.

TOP and its Walt wallet will continue to operate independently. In early 2026, TOP planned to buy the popular non-custodial wallet Tonkeeper from its founders. The full acquisition of its shares did not go through, but in August 2026 TOP took over Tonkeeper’s operations. Tonkeeper also owns the Tonviewer blockchain explorer, which was used in official Telegram apps to inspect blockchain transactions.

In 2026, this blockchain explorer, which was under the control of Rogozov’s company, began displaying casino ads, so Telegram replaced it with Tonscan. Telegram chose not to return to Tonviewer even after it removed the ads.

It’s worth noting that Telegram’s new wallet is not being built from scratch: Gram Wallet is being developed in collaboration with the My Wallet team (formerly MyTonWallet). The project includes native integration directly into Telegram apps, as well as a standalone iOS/Android app and a web version. Telegram’s wallet is fully non-custodial.

#TON

Interactive web messages right in the chat

The TBetaLeak channel discovered a large experimental subsystem called HTMLBubbles in version 12.10.283300 of Telegram for macOS.

According to the description, the messaging app is testing interactive messages built with HTML, CSS, and JavaScript right in the chat, without the need to launch a separate Web Mini App window.

@tginfo editors have confirmed the module’s presence in the code of that version based on a preliminary review, but the described behavior and how it works have not yet been independently verified.

The idea is to turn ordinary messages into widgets: product cards with selectable options, interactive boarding passes, or live charts.

According to the source, rendering is handled by the compact litehtml engine, while scripts run in a heavily restricted sandbox with CPU limits, network requests blocked, and external media prohibited. You can read all the technical details about these restrictions in the source post.

Editors’ concerns

Despite the extensive list of restrictions, @tginfo editors have serious security concerns about this kind of feature. Integrating web engines that support JavaScript execution — even in a heavily restricted form — directly into the chat interface poses a huge risk.

Experience shows that no matter how thoroughly developers isolate an environment, vulnerabilities are regularly found in rendering systems. The risk of malicious code running simply by viewing a chat raises serious questions about whether these widgets are worth it.

For now, HTMLBubbles is an early experimental concept being tested within the Telegram team. The feature could change substantially during development or be canceled entirely.

#macOS #beta

Dangerous vulnerability in Telegram Desktop: any file can be stolen with one click

What you MUST NOT do and how to protect yourself:
• Do not keep using versions earlier than 7.2.9 — update the client immediately. If you use an unofficial client, temporarily switch to the official one until an update is released.

Download:
• Windows / macOS / Linux: official website or GitHub.
• Windows: Microsoft Store.
• macOS: App Store.
• Linux: Flathub, Snapcraft.

Advice for users of older clients:

• Links can be dangerous: whenever you click a link, read the pop-up window carefully — if Telegram shows an unusual structure in the link (for example, one starting with tg://), do not open it.

• Do not use the client without a local passcode: enabling one encrypts the session files in the tdata directory, preventing immediate account hijacking even if those files are leaked.

What is the issue?

A vulnerability has been discovered in Telegram Desktop clients earlier than version 7.2.9 (CVE-2026-107181). Because the ; delimiter was not escaped, parameters in tg:// links were interpreted as separate IPC commands. Using the interpret: handler, an attacker could cause files from the system to be sent covertly to their channel, without the user’s confirmation, when the user clicked a specially crafted link.

The main risk

The danger is not limited to stealing tdata session files and hijacking accounts. Exploiting the vulnerability makes it possible to covertly steal absolutely any files on the computer that the user can access: documents, saved browser sessions, SSH keys, system configurations, or cryptocurrency wallets.

#security #desktop #vulnerabilities

Telegram updated to version 13.0: native wallet and instant Gram transfers

Telegram has begun rolling out its own non-custodial wallet, Gram Wallet, in stages. For now, the service supports only Gram cryptocurrency and NFTs associated with the messaging app: collectible gifts and usernames, and anonymous numbers.

Gram Wallet is currently available to a limited number of users. To unlock access to the wallet before it rolls out to all Telegram users, you’ll need to update the app to the latest version and receive a transfer of at least 0.1 Gram from another user.

Once the wallet is activated, its balance will appear in the “Money” section of Settings, in place of the Wallet bot, which was renamed Walt and hidden from the main menu shortly before the native wallet launched. You’ll also be able to instantly send Gram to people you’re chatting with through the Gram tab in the attachment menu of a one-on-one chat.

One feature of the integrated wallet is the ability to make up to five Gram transfers a day to other Telegram users or wallet addresses without paying TON blockchain fees. The first transaction, however, is subject to a smart contract initialization fee.

Subscribe to our channel @infoton to stay up to date on developments involving the TON blockchain and Gram cryptocurrency.

Download the update
• Android: Google Play, APK from the official website or the verified channel.
• iOS: App Store.
• Windows / macOS / Linux: official website or GitHub.
• Windows: Microsoft Store.
• Linux: Flathub, Snapcraft.
• macOS: App Store or the verified channel.

#update #Android #iOS #Desktop #macOS

Telegram Is Testing a News Feed and Personalized Recommendations Again

A separate “News” tab for viewing channel posts in a unified feed has appeared in Telegram for macOS Beta 13.0 (283318). The @telelakel channel reported the discovery.

How the news feed works

The current implementation of the post feed has several key features:

• Two sections: The “News” tab is divided into two sections — “Added” and “For You”.

• Custom feed: In the “Added” section, users can manually curate their feed by adding and removing selected channels through dedicated interface actions.

• Personalized recommendations: The “For You” section curates posts based on the user’s interests. Categories of interest (each with its own name and emoji) can be selected manually and changed over time. However, it remains unknown what algorithm powers this feed and whether it will include posts from channels the user isn’t subscribed to.

• Navigation and speed: The feed interface includes a search bar, pull-to-refresh, a new posts indicator, and a button to mark posts as read. Directly from the feed, users can open individual posts and channels, jump to chats, and copy links. For faster browsing, media files, profile pictures, and stories are preloaded in the background.

Background and context

The messenger’s team has been approaching the creation of a unified feed for eight years:

• The ability to combine channels into a unified news feed first appeared in the Beta version of Telegram for macOS back in January 2018, but was soon disabled on the server side.

• In April 2022, a commit confirming the development of a news feed was spotted in the official Telegram for iOS repository, though the feature never made it to release.

• Meanwhile, between 2019 and 2021, Telegram held a series of large-scale contests focused on news ranking and data clustering, as well as identifying channel languages and topics.

• Until now, the primary way to read subscriptions sequentially in the messenger has been the gesture for jumping to the next unread channel, while algorithmic recommendations have been limited to the “Similar Channels” list and the “Channels” tab in global search.

@tginfo editors note that introducing an algorithmic feed in the spirit of X (formerly Twitter) could significantly reshape how content is consumed in the messenger. For creators, it is a potential source of free organic traffic without buying ads, and for Telegram itself — a way to boost audience engagement and increase impressions for official ads.

Currently, the news feed is disabled on the server side and remains in development — its mechanics and appearance may change by the time of release.

We share more news about features from test builds in our Beta Info channel.

#beta #macOS #channels

Telegram Introduces Free Message Links and an Updated QR Code Editor

The personal profile QR code screen has been updated in the Beta versions of Telegram for iOS 13.0.1, Telegram for macOS 13.0, and Telegram for Android 13.1. Alongside new appearance settings, the messenger now allows users to generate special links and QR codes that let others message them for free even when paid messages are enabled.

How it works

If you have set a fee in Stars for incoming messages, a “Remove message fee” button now appears below your profile QR code.

When activated, it appends a randomly generated access token to your profile link. Your regular profile link will still require payment, while sending messages for free will only be available to those who follow the link or scan the QR code containing a valid token.

By default, the generated QR code is temporary and remains valid for 1 minute — this is handy when you want to show it to someone on your phone screen in person.

In the code management menu, you can adjust these settings: make the link permanent (Disable timer), limit its validity to one minute again (Expire after 1 minute), reset the token to invalidate the old link (Reset Code), or re-enable paid messages altogether (Restore message fee).

This feature is useful if you want to protect yourself from spam and unsolicited direct messages while still providing a “free” entry point on your website, on a business card, or in a private community where friends or potential clients might look for you, or if you want to automate link distribution via a bot.

New QR code design

Customizing the QR code’s appearance is no longer limited to preset themes: users can now pick colors from a wide palette, use any emoji as a background pattern, or select unique collectible gifts from their profile (the latter requires a Telegram Premium subscription).

Because of this, only the account owner can now manage the appearance of their QR code screen. Any decorations applied to the link’s design are visible to other users.

#iOS #macOS #Android

Gift Sale Scam

In recent days, there has been a rise in scams targeting users who own collectible gifts.

How the scam works
A user receives a message in a private chat that looks like an official gift purchase offer. In this message, the scammer prompts the victim to tap a button to transfer the gift to the buyer, promising that the victim will immediately receive a reward in Stars. In reality, however, the button contains a link that simply transfers the gift to another user for free.


How to verify a purchase offer?
Here is how you can tell a genuine gift purchase offer from a fraudulent one:

• A genuine offer is displayed in the center of the screen, whereas a fraudulent one is aligned to the left (just like regular messages from your chat partner).

• A genuine offer contains a small image of the gift the buyer wants to purchase, the text “The user offered you xxx ⭐️ for your gift <gift_name_with_number>”, the offer’s expiration time, and the “Decline” and “Accept” buttons. The content of a fraudulent message may differ.

• If you change the app’s interface language to English, the text of a genuine offer will also be displayed in English. The language of a fraudulent message will not change.

• If you press and hold the “Accept” button in a genuine message, nothing will happen. If you do the same on the button in a fraudulent message, the Telegram app will reveal the link hidden behind that button — typically, this link starts with tg://send_gift.

Please be on alert when receiving gift purchase offers: check them carefully to avoid losing your gifts.

How to protect yourself from risk?
If a gift is hidden on your profile, no one will be able to send you an official offer to buy it. To hide a gift from your profile, open your list of gifts, tap on the desired gift, and then tap the “Hide” button.

What to do if you have already transferred the gift?
1. It is impossible to get the gift back. You will not be able to prove to Telegram Support that you were deceived. Providing them with screenshots is pointless: they can be forged, and Telegram moderators do not have access to private chats.

2. You can report scammers to Telegram: see section 1.2 (“Report Violation”) of our article “How to contact Telegram?”. Unfortunately, a single report is usually not enough for Telegram moderators to ban a scammer’s account. Moreover, scammers typically have many backup accounts.

#security #gifts #scam

Telegram for Android, iOS, and macOS Have Been Updated to 13.1, and Telegram Desktop to 7.3.2

The October Telegram update brings new features related to customizing the Gram Wallet, personalizing your profile, and managing gifts.

• Customizing the Gram Wallet card: Users can now decorate their crypto wallet card with collectible gifts. These can be placed as stickers, and also used to customize the background.

Currently, only gifts from the Plush Pepe and Resistance Dog collections are available for the background.

• Gram Wallet balance in profile: User profiles now feature a crypto wallet card displaying the balance. Other users can tap on it to see the chosen customization.

The balance is only displayed if there are at least 0.01 Gram in the wallet. If there are fewer funds, it will be hidden from the profile.

• Personalizing QR codes: Telegram has updated the profile QR code editor, adding the ability to change the background, decorate it with emojis, and apply customizations using collectible gifts.

The chosen design will be visible to other users. Most of the new settings are only available to Telegram Premium subscribers, while changing the color remains free.

• Links for free messages: Users who have enabled payment for incoming messages can now create special links that allow other people to message them for free.

Whenever necessary, the right to sending free messages can be revoked from a specific user.

• Simplified transfer of NFT gifts: When sending a gift, there is now an option to transfer it to your own wallet on the TON blockchain without the need to use Fragment.

• Deleting non-unique gifts: It is now possible to delete non-unique gifts.

Other new features
• Added support for quoting rich messages. Previously, only regular messages could be quoted.
• Telegram Desktop for Windows has been updated to Qt 6, the new major version of the cross-platform framework on which the application's interface is built.

Download the update
• Android: Google Play, APK from the official website or the verified channel.
• iOS: App Store.
• Windows / macOS / Linux: official website or GitHub.
• Windows: Microsoft Store.
• Linux: Flathub, Snapcraft.
• macOS: App Store or from the verified channel.

#update #Android #iOS #Desktop #macOS

Interactive HTML Messages Are Now Working in the Android App

A working prototype of the experimental HTMLBubbles technology is confirmed in the Beta version of Telegram for Android 13.2.

It makes it possible to create interactive messages built with HTML, CSS, and JavaScript that are displayed right in the chat without opening a separate Mini App. To test the feature, @tginfo editors created their own HTML widget. Using it, they confirmed the execution of JavaScript and basic functions of regular websites.

Similar components were also found in the Beta version of Telegram for iOS 13.2, which now includes built-in tools for testing widgets as well.

Security concerns

So far, no dedicated toggle to disable HTMLBubbles has been found in the settings of the tested Beta versions.

Previously, @tginfo editors expressed concerns about executing JavaScript right in the chat.

As a reminder, a vulnerability (CVE-2026-107181) was recently discovered in Telegram Desktop that allowed files to be stolen through specially crafted links.

Although that flaw is unrelated to HTMLBubbles, introducing a new mechanism for executing code inside messages could lead to much more severe vulnerabilities that require no user interaction to trigger (zero-click).

When will the feature be available to everyone?
For now, HTMLBubbles remains an experimental technology. The ability to send such messages is restricted, and a public API for developers has not yet been introduced.

#Android #iOS #beta

Researcher Bypassed Telegram’s Server-Side Sticker Verification for a Zero-Click iOS Hack — Meanwhile, the Messenger Replaced the Vulnerable Library

UPD 22:00 UTC. The researcher confirmed that Telegram has patched the flaw when migrated its clients to the tlottie library. Official clients users with latest updates installed are safe.

Cybersecurity specialist Saifeldeen Aziz announced a talk at the OffensiveCon conference — the researcher spent a year studying the security of Telegram stickers. Telegram very recently overhauled its sticker library, so without further details, it remains unclear whether the updates have fixed the announced vulnerabilities.

There is likely no direct threat to Telegram users on the latest versions of the official apps right now.

What exactly did the researchers find?

• Using AI-driven fuzzing, the cybersecurity team found several vulnerabilities in the rlottie library, which is responsible for rendering animated stickers. In Telegram for iOS, this makes it possible to execute code on the victim’s device.

• Telegram relies on server-side verification to filter out malicious files.

• The researcher discovered logic flaws in how stickers are delivered and verified, using them to bypass the security mechanisms.

• According to the author, even after receiving the reports, Telegram continues to rely on server-side checks, while the vulnerable rendering code remains in the official clients.

Telegram replaced its sticker library

While the research was underway, Telegram changed its approach. The messenger published tlottie — a new sticker rendering library vibe-ported to Rust. It is already used in Telegram Desktop, Telegram for macOS, and Telegram for Android; since September, it has also been used in Telegram for iOS.

The tlottie library eliminates an entire class of memory bugs that have been used for sticker-based attacks for years. In the view of @tginfo editors, by updating the library in client apps, the messenger’s team demonstrates that it does not rely solely on server-side checks in matters of security.

Are these findings still relevant?

• The presentation materials have not yet been published online. Which versions the exploit chain was tested on and the exact nature of the vulnerabilities will become known later.

• The research took a year, and the announcement specifically focuses on rlottie. Therefore, there is reason to doubt that the issue persists in the latest versions, although this still cannot be ruled out. Furthermore, logic flaws in sticker delivery and verification do not depend on the rendering library.

• Rust is no guarantee. There have been no independent audits or public analyses of tlottie yet, so the library will only be able to prove its quality over time.

A systemic problem

The history of sticker vulnerabilities goes back many years. Back in 2020, Shielder researchers discovered 13 bugs in rlottie that allowed for remote memory corruption on a device. At the time, Telegram only patched those specific errors.

Meanwhile, the company publicly denied the risks. In 2025, the exploit broker Operation Zero offered up to $4 million for zero-click exploits targeting the messenger, while a Telegram representative told Forbes that the messenger had “never been vulnerable to zero-click exploits”.

In March 2026, an entry regarding a vulnerability in Telegram stickers appeared in the Zero Day Initiative database. The messenger’s press service stated to Durov’s Code that “the existence of such an exploit is impossible” because all stickers are checked by servers. At the time, @tginfo editors pointed out that server-side validation is merely one layer of protection that can itself contain errors — a conclusion supported by the findings of the new research. In October, ZDI published the full details of the vulnerability, marking it as unpatched.

In their announcement, Saifeldeen Aziz questions Telegram’s approach to security and speculates that such vulnerabilities could be used to create backdoors.

In the view of @tginfo editors, the transition to tlottie is the first step in many years toward solving the underlying problem rather than applying another patch. Telegram often aggressively denies the possibility of any vulnerabilities or silences issues. @tginfo editors note that trust is built not by such declarations, but by openly acknowledging problems and allowing independent code verification.

#vulnerabilities