Operation Navy Ghost — 8 fake pyrogram packages on PyPI target Telegram bot developers with full-server backdoor using Telegram as C2 (Jun 2026)

TL;DR

A threat actor published 8 fake pyrogram forks to PyPI over 6 months (November 2025 – June 2026), planting a hidden backdoor that grants full remote shell and file-system access to any server running the infected bot — using the victim's own Telegram bot as the C2 channel, bypassing traditional network egress monitoring. ~24,300 total downloads across all malicious packages.

What happened

Between November 22, 2025 and June 7, 2026, a threat actor operating under three PyPI identities (wndrzzka, narutorawr18, deylin) published 8 malicious packages to PyPI, each a trojanized clone of the legitimate pyrogram Telegram bot framework (347,395 monthly downloads).

The attackers injected a hidden file, pyrogram/helpers/secret.py, into legitimate pyrogram source code. The backdoor registered invisible Telegram command handlers that activate when messages are sent from 16 attacker-controlled Telegram accounts:

Stolen data travels back through Telegram itself — using the victim's own bot token to send document attachments to the attacker. No outbound connection to an unfamiliar IP or domain is required; the exfil blends in as normal bot traffic on api.telegram.org.

Two injection techniques were used across packages: (1) import-time execution wired at the top of __init__.py, and (2) a hook buried inside the Client.start() lifecycle method — so the backdoor fires either at module import or at bot startup, depending on the variant.

The campaign operated under three separate PyPI publisher identities and published 32+ package versions in total. The shared Telegram control account ID 327471892 across multiple packages indicates coordinated operation rather than independent actors.

Affected packages and download counts

All packages have been removed from PyPI following Checkmarx's disclosure on June 25, 2026.

Am I affected?

Check your Python environment for any of the malicious package names:

# Check installed packages
pip show pyrogram-navy vlifegram vlife-gram kelragram pyrogram-styled sepgram pyrogram-zeeb pyrogram-kelra 2>/dev/null | grep -E "^Name:|^Version:"

# Check pip install history (Linux)
grep -E "pyrogram-navy|vlifegram|vlife-gram|kelragram|pyrogram-navy|pyrogram-styled|sepgram|pyrogram-zeeb|pyrogram-kelra" \
  ~/.local/share/pip/logs/*.log 2>/dev/null

# Check for the hidden backdoor file in any pyrogram installation
find $(python -c "import site; print(site.getsitepackages()[0])") \
  -path "*/pyrogram/helpers/secret.py" 2>/dev/null

If you find the backdoor file:

# Confirm the file exists (legitimate pyrogram does NOT have helpers/secret.py)
python -c "import pyrogram; import os; print(os.path.join(os.path.dirname(pyrogram.__file__), 'helpers', 'secret.py'))"

Signs of compromise: - Any of the 8 package names in pip list or install logs - pyrogram/helpers/secret.py present in your pyrogram installation - Unexpected Telegram messages from your own bot (the backdoor uses the bot's own token) - Unexplained file uploads in your bot's sent-messages history

If you are affected

1. Stop all affected bots immediately — the backdoor uses the bot's own Telegram session, so simply stopping the process terminates attacker access to the C2 channel.
2. Revoke all Telegram bot tokens for bots that ran under affected packages, and generate new tokens via @BotFather. Token revocation invalidates any session the attacker may have been using.
3. Treat the server as compromised — the backdoor provides arbitrary shell and Python execution, meaning the attacker may have installed persistence, exfiltrated secrets, or pivoted. Follow the full server-compromise playbook.
4. Rotate all credentials stored on the server — API keys, database passwords, cloud credentials, SSH keys, .env files. Assume anything readable by the process was exfiltrated.
5. Reinstall from the official pyrogram package on PyPI: pip install pyrogram.

→ Playbook: if your webapp was compromised → Playbook: rotating cloud credentials

Prevention

• Install only the official pyrogram package. The legitimate package is pyrogram (note: no suffixes, no "navy", no "styled", no user prefix). Verify publisher: pip index versions pyrogram should show the official Pyrogram maintainer.
• Pin package versions with hash verification in production bot deployments: pyrogram==2.0.106 --hash=sha256:<known-good-hash>
• Audit your requirements.txt for unfamiliar pyrogram forks. Any package with a pyrogram-* name that isn't the official one is suspect.
• Monitor for new command registrations in your bot. If your bot suddenly responds to commands you didn't implement, it may be compromised.
• Restrict server outbound access — even though this backdoor uses Telegram's API (which most orgs allow), limiting file-upload endpoints and monitoring for unexpected Telegram API calls from backend servers adds detection opportunity.

→ Prevention: supply chain attack surface → Prevention: package vetting checklist

IOCs

Technique note

The Telegram-as-C2 pattern is distinct from every other PyPI backdoor tracked in this repo. Prior campaigns exfiltrate to attacker-controlled servers (GitHub Gists, disposable SSH tunnels, Google Calendar dead-drops, AI-vendor API host camouflage). This campaign uses the victim's own bot token to relay control through Telegram's infrastructure — which is allowlisted in virtually every corporate egress policy for bot deployments. Network-layer egress monitoring that flags unknown IPs or unexpected domains will not catch this technique.

Update 2026-08-05 — a second, unrelated Telegram-bot-framework backdoor confirms the caution's own prediction

Pyronut (Endor Labs, disclosed 2026-03-18) is a separate, single-source incident, not part of Operation Navy Ghost — different package name, different publisher, no shared IOCs with the packages/accounts listed above — but it targets the exact same demographic (developers building Telegram bots on top of pyrogram) with a similar impersonation strategy: pyronut copies pyrogram's project description and code to look legitimate, then patches the Client.start() method to silently import a hidden backdoor module every time a Telegram client starts. Unlike Navy Ghost's install-time-style trojan, Pyronut's payload fires at runtime, on every bot startup, and grants two hardcoded attacker Telegram accounts arbitrary Python and shell execution on the host. Endor Labs identified and had the three malicious versions (2.0.184–2.0.186) quarantined the same day they were published, limiting exposure. This repo has not found independent corroboration beyond Endor Labs' own writeup and its direct aggregator mirrors, so treat the specifics as unconfirmed pending a second independent source — but the pattern itself (Telegram bot developers on PyPI as a repeat target, C2/persistence riding the developer's own trusted messaging integration) is now observed twice in under a year and matches this advisory's own prediction that the technique would generalize to other Python Telegram bot frameworks.

• Endor Labs — Malicious 'Pyronut' Package Backdoors Telegram Bots with Remote Code Execution — sole source for the Pyronut incident; package versions, discovery date, backdoor mechanism.

Sources

• Checkmarx Zero — Operation Navy Ghost: How Attackers Planted a Telegram-Powered Backdoor Across Fake pyrogram Packages on PyPI — primary disclosure; full package list, version counts, download totals, attacker Telegram IDs, YARA rule, injection technique analysis; published 2026-06-25.