Command-and-control, or "C2," is the channel malware uses to phone home — to receive instructions from an attacker and send back stolen data. Attackers used to have to run and maintain their own servers for this, which meant an IP address or domain that defenders could eventually flag and block. Increasingly, they don't bother. They use Telegram and Discord instead.
Why attackers prefer them
- Free, reliable hosting. Telegram and Discord's infrastructure is well-maintained, globally distributed, and free to use — an attacker gets enterprise-grade uptime without renting a single server.
- They blend into normal traffic. Telegram and Discord's domains are used by millions of legitimate users and businesses. Traffic to them rarely triggers the alarm that a connection to an unfamiliar server would.
- Built-in APIs do the hard part. Both platforms offer bot APIs designed for legitimate automation — sending messages, receiving commands, uploading files. Malware authors repurpose the exact same features: a Telegram bot token becomes a ready-made, encrypted, authenticated command channel.
- Takedown is slower and messier. Blocking a malicious domain is a routine defensive action. Blocking Telegram or Discord outright breaks legitimate use for everyone else, so defenders are often stuck detecting behavior instead of blocking infrastructure wholesale.
How it works, conceptually
Infected devices are configured to poll a bot account or a specific channel/webhook for new messages. An attacker posts a command in that channel; the malware on the victim's device picks it up and executes it, then posts results or stolen files back through the same channel. From the network's point of view, this looks like ordinary API traffic to a mainstream chat platform — encrypted, and indistinguishable at a glance from a legitimate bot checking for notifications.
The infrastructure isn't the tell anymore. The behavior is.
Red flags worth knowing
- An application with no obvious reason to talk to Telegram or Discord's API doing so persistently in the background.
- Regular, small, periodic outbound connections to chat-platform domains from a device or process that isn't a chat client.
- Unexplained bot tokens or webhook URLs found in scripts, browser extensions, or downloaded tools — especially ones bundled with cracked software or "free" utilities from unofficial sources.
- New device enrollment or file uploads from an account you don't recognize, on a shared bot or channel you were invited to without a clear explanation.
What actually helps
- Only install browser extensions, cracked-software alternatives, and "free" tools from sources you fully trust — this remains the most common way this kind of malware gets a foothold in the first place.
- For organizations, monitor for unexpected, repetitive traffic to consumer chat-platform APIs from machines that have no legitimate business reason to use them.
- Keep endpoint detection tools updated — vendors increasingly build signatures for this specific abuse pattern, since it's become common enough to be well studied.
None of this is a flaw in Telegram or Discord themselves — it's a predictable consequence of building reliable, free, encrypted messaging infrastructure and making it programmable. The same properties that make these platforms good for legitimate automation make them good for attackers too.