A newly documented malware operation, tracked as TWEAKOS, is notable less for its technical sophistication than for how openly it turns account theft into a retail business. The setup pairs a Windows-based credential stealer with a Telegram bot that doubles as a management console and a storefront, and researchers only found out about it because its own source code turned up on Pastebin.

Analysts at threat intelligence firm Flare, who shared their findings with Cyber Security News, recovered two related Python components that make up the operation, though they say it’s still unclear exactly how the stealer reaches victims or how many people have been affected so far. What is clear is that running the malware can expose a victim’s Discord account and generate a reusable, hijacked Telegram login session — both of which then feed directly into a sales pipeline.

A Stealer That Knows What It Wants

Once TWEAKOS lands on a Windows machine, it sets itself up to survive a reboot without needing administrator rights: a packaged version drops a copy of itself into the user’s Startup folder, while a script-based version adds a user-level startup entry instead. Either way, it persists quietly and starts running again the next time the user logs in.

From there, it searches for Discord authentication tokens across the places Discord and its test build store them locally, plus Chrome’s default profile. Each token it finds gets verified directly against Discord before being forwarded to the operators over Telegram, so operators aren’t wasting time on dead credentials. Notably, the Chrome-side search is narrow by design — it does not touch saved browser passwords, cookies, or the browser’s encryption keys, which sets it apart from the broader browser-theft behavior seen in many other Discord-focused stealers.

Hijacking Telegram, One Login Code at a Time

TWEAKOS also runs a separate routine aimed squarely at Telegram, though this part requires the victim to actively interact with it — entering a phone number, a login code, and, if the account has one enabled, a cloud password. Using the Telethon library, the malware then establishes a fresh, authenticated session and, if the resulting session file exists, forwards a copy to two separate operator accounts so they can reuse the login themselves.

Importantly, Flare’s analysis found that while the code can generate a new password string, it never actually changes the account’s real password. That’s a meaningful distinction for anyone trying to assess their exposure: the danger here is an authenticated session sitting in someone else’s hands, not confirmation that a password has been reset. No specific delivery lure — the bait used to get victims to run the malware in the first place — was identified in the report.

The Storefront Behind the Bot

The second component is where TWEAKOS distinguishes itself from a typical stealer: a Telegram bot that functions as a full point-of-sale system, tracking victims, buyers, products, and completed orders in a local database. The shop sells both Telegram and Discord accounts, issues invoices in Telegram’s in-app currency, and delivers credentials to buyers once payment clears. Prices drop by 5% each day a listing goes unsold, up to a maximum discount of 70%, with a floor of a single Telegram Star — a pricing model reminiscent of other Telegram-based criminal marketplaces, but unusual in being wired directly into the theft operation itself rather than run as a separate service.

Operators using the bot can browse victim records, message compromised accounts directly, and trigger a script that displays a repeating warning message on a victim’s screen — a feature whose exact purpose (intimidation, distraction, or something else) isn’t fully clear. A related feature references a “security update” payload that researchers were unable to recover or verify.

Sloppy Bookkeeping, Real Risk

Flare’s research also found the link between the theft and the bookkeeping side is imperfect: stolen material is sent straight to operator chats, while the bot’s own database only logs incoming messages from non-operators, and a capitalization mismatch between the stealer’s output and the bot’s Discord validation check means some compromised accounts may never make it into the sales records at all — even though the operators already have their details in hand.

For anyone concerned about exposure, the practical advice remains the same as for most token-based stealers: enable two-factor authentication everywhere it’s offered, treat unsolicited Telegram login prompts with suspicion, avoid running unverified executables from Pastebin, Discord, or gaming-adjacent forums, and periodically review and revoke active sessions on both Discord and Telegram rather than assuming a strong password alone is enough.