Armored Likho Still Toolkit Steals Telegram Sessions and Records Victims’ Conversations

A cyber-espionage operation linked to Armored Likho is using a convincing donation app to reach people and organizations in Russia.

Once opened, the fake application quietly installs tools designed to take over Telegram accounts and capture private conversations.

The campaign matters because it combines account access with microphone surveillance.

A compromised person can lose chat histories, files, contacts, and spoken discussions in one incident, creating serious privacy and business risks.

Unlike a conventional steal-and-leave operation, it gives operators a way to watch a target’s communications over time and build a more complete picture of personal or organizational activity.

That persistence can multiply the harm, especially for staff with access to sensitive projects, customer data, or internal decision-making across affected public and private organizations.

Securelist said in a report shared with Cyber Security News (CSN) that it discovered the campaign in May 2026.

Its researchers identified the new Rust-based Still Toolkit while examining activity against private individuals, companies, government bodies, IT firms, and education organizations in Russia.

The initial delivery route remains unclear, but the lure is familiar. Victims receive software posing as a service for charitable donations, then see a password screen and a catalog of items that makes the program appear genuine while the hidden payload starts in the background.

Armored Likho

The toolkit’s first component, Still Sync, looks for Telegram Desktop session data.

That information can allow an attacker to resume an already authenticated account, a danger illustrated by the risks of cloned Telegram sessions, without having to know the victim’s ordinary login credentials.

After it gains access, Sync can use Telegram’s application interface to collect account details, private chats, groups, channels, and media files smaller than 250MB.

It can also gather names, phone numbers, membership details, documents, stickers, photos, and contacts, turning one endpoint infection into a broad intelligence haul.

The malware first registers the infected device with its command server and waits for settings that switch on its collection features.

It searches normal and portable Telegram locations, and can attempt backup-based methods if standard file access fails, making a missing file permission prompt a poor sign of safety.

This approach is distinct from password phishing. It abuses local proof that a user has already signed in, which is why recent Telegram authentication phishing and session theft demand attention even when two-step verification is enabled.

A separate desktop passcode can add protection to locally stored Telegram data.

Audio Module Extends Surveillance

Still Audio adds a second layer of spying by monitoring an available microphone for speech.

When sound crosses a set threshold, it begins recording, keeps a small buffer so the start is not missed, converts the audio to MP3, and sends it to the operator’s infrastructure.

The module can run in the background as a Windows service, yet researchers found that it did not fully conceal microphone use.

In the examined sample, the program appeared in Windows microphone settings under a name resembling a legitimate audio component, an important clue during incident response.

Its fallback design also lets the operators change server addresses if a primary connection is unavailable for three days.

That resilience resembles ClickFix malware delivery chains, where modular threats fetch new functions or replacement infrastructure instead of relying on a single fixed server.

Researchers linked the campaign to Armored Likho, also called Eagle Werewolf, through code and infrastructure similarities with earlier operations.

The group’s move to a combined toolkit reflects a wider trend seen in Rust malware surveillance campaigns: compact modules can collect several forms of sensitive data after one deceptive click.

People who installed a suspicious donation app should disconnect the device from networks, preserve evidence, and have a trusted security team examine it.

From a clean device, they should review Telegram’s active sessions, terminate unfamiliar ones, reset relevant passwords, and consider the chats and recordings exposed.

Organizations should block the indicators below, hunt for related activity, and notify affected users promptly.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world