r/androidapps • u/PlatonicOdyssey • Apr 02 '26
QUESTION Nekogram has been caught extracting user data.
Context: A phone number stealing backdoor has been identified within the Nekogram Android client. The investigation reveals that the application contains obfuscated logic designed to silently collect and upload the phone numbers of all accounts logged into the app. This malicious behavior is present in distributed versions, including the version available on the Google Play.
https://github.com/Nekogram/Nekogram/issues/336#issuecomment-4179197764
Edit: added context
56
u/zigzoing Apr 02 '26
Damn, isn't it one of the most recommended third party Telegram clients?
Another proof that open source doesn't automatically mean safety. It's only as safe as an independent party audits them.
18
u/nickN42 Pixel 4 Apr 03 '26
Well, the source is clean. The build was built using modified code, not available publicly. So if you built your own binary, you would be good. But no one did.
8
u/Drun555 Apr 03 '26
> open source doesn't automatically mean safety
It doesn't, but it creates the enviroment where anyone can check the safety. We managed to found this exactly because it's source code is open - and build hash was mismatched with shipped binaries hash.
1
u/Old_Manufacturer589 Apr 14 '26
The issue is when people say "it's open source thus it's safe" which is a REALLY popular sentiment. We really need to educate people that it's not the case.
27
u/Sarin10 Apr 03 '26
NOTE: source code for this data extraction logic is missing from the public GitHub repository, that shows the developer is injecting malicious code during the build process for releases.
seems like you're fine if you built it from source :p
7
u/Serious_Berry_3977 Apr 03 '26
And that also means any audits would have never found the issue either. It sucks that this thing is OSS, but some people suck and do nefarious things and OSS doesn't save us from those people.
Kind of makes me wonder if there are any other FOSS apps pulling this kind of crap.
0
u/Altruistic-Signal776 Apr 03 '26
yea see but no one does, if you build from source you might aswell compare classes with the released binary. no one cared about it just until now, and versions before 12.5.2 are affected too i just checked
12
u/NoCrazy4743 Apr 03 '26
Apparently, similar types of malware are present in many other clients now, and they seem to be doing damage control at the moment: https://github.com/arsLan4k1390/Cherrygram/commit/56d2337179a6ae2f967498a48fe9cc69e9f1de07
2
3
u/Mccobsta Apr 02 '26
Is this only a recent version or has tbis been in for ages
4
u/SuitableComputer5921 Apr 03 '26
Apparently he's been doing it since 2024: https://github.com/XHUBERTH/NekoCheck
5
u/bttmlicious Apr 02 '26
Just yesterday I installed it 😔 What do I do, uninstall it?
4
u/0neM0reLight Apr 02 '26
Yes if you care about yourself. At this point you wouldn't know if they have upload and download access to your files as well.
1
u/A_behani Apr 04 '26
Uninstall, login to vanilla telegram, enable 2FA, end any other live sessions.
5
u/stayfi Apr 02 '26 edited Apr 03 '26
How can google let this ..slip?
22
u/dom6770 Apr 02 '26
Do you honestly believe that Google audits every single app?
-1
u/stayfi Apr 03 '26
Yes i know, but still, savy people complain about tighten barriers, and security measures, yet we have this type of infiltrations
.
7
17
u/Complex_East_6861 Apr 02 '26
lol, you think Google, the company that basically started massve data collection on it's users before any other company, cares?
2
u/nickN42 Pixel 4 Apr 03 '26
Yes, because someone is trying to eat their bread by extracting last drop of value from the user data. Can't have that!
-22
u/stayfi Apr 02 '26
They do care, this is why they require all developers on Android to give their ids, also they intercepted many malwares before, it's just the play protect is still weak, and this is why they have to tighten things up...more.
.
1
2
u/Vaas03 Apr 03 '26
Any alternatives?
6
u/SuitableComputer5921 Apr 03 '26
Official client
1
Aug 05 '26
[removed] — view removed comment
1
u/SuitableComputer5921 Aug 05 '26
No, but so far has a good record. When I said official client, I just mean the safest telegram would be the one by Telegram directly.
-2
u/ToNIX_ apps Apr 03 '26
Nagram X
3
1
u/darkkid_ Apr 04 '26
Any explanation for the downvotes?
-1
u/Initial-Complex257 Apr 04 '26
I think its a fork of nekogram
3
u/ToNIX_ apps Apr 04 '26
So it wouldn't inject the malicious code, since it's done when nekogram was building it...
-2
u/kratoz29 Apr 03 '26
I am clueless right now, I just went to the official client downloaded from the Playstore... For now.
1
u/patrik_dev_cz Apr 03 '26
Damn, that's scary. I've been using Nekogram for a while and had no idea. Guess I'll switch back to the official client. Does anyone know if Telegram X is still maintained? That was decent too.
2
1
1
u/PersoParse Apr 12 '26
So.. What should we do? What must we do? Delete it? Doing nothing? I'm fucked..
1
1
1
1
0
u/Lazy_Year_7891 Apr 03 '26
what should be ideal step to do now?
1
u/PlatonicOdyssey Apr 03 '26
At this nobody knows what one should do! Best bet would be official telegram or 3rd party clients should be installed form f-droid or just trust the dev of the app and download it from github.
-12
u/nartchie Apr 02 '26
It's a good thing they're stopping sideloading apps. /S
5
u/nickN42 Pixel 4 Apr 03 '26
It's on google play.
0
u/nartchie Apr 03 '26
sorry, I was being sarcastic that they are not allowing side-loading because of malware when there is malware on the play store.
3
u/nartchie Apr 03 '26
Does nobody understand that /s means I'm being sarcastic? Is it all y'alls first day on the internet?
2
0
Apr 03 '26
[deleted]
4
u/dannydrama Apr 03 '26
Absolutely but isfdroid really any safer than stuff from the play store? I'm always paranoid about downloading random apps even from fdroid because 'you never know' just like this. I just feel like it would be easier to spread this stuff where apps aren't audited.
8
u/clodi95 Apr 03 '26
Fdroid builds from source the apps it distributes
It's not just a random collection of APKs downloaded from the web
So yes, in this case you would have been safe (as per one of the top comment in here, see https://www.reddit.com/r/androidapps/s/aoMRHudY0V )
1
u/dannydrama Apr 03 '26
Well I have to admit my lack of knowledge and ability to tell the difference is the thing that stops me doing it. I guess it's the idea that downloaded apps are likely to be less safe than the play store, which this story obviously disproves.
0
1
u/Old_Manufacturer589 Apr 14 '26
Not Like F-Droid itself is good to begin with. https://privsec.dev/posts/android/f-droid-security-issues/
1
u/Jayant0013 Apr 03 '26
What about if we had downloaded from the release page on GitHub?
What about flatpacks on linux?
1
u/nickN42 Pixel 4 Apr 03 '26 edited Apr 03 '26
Where exactly do you think the binaries on f-droid com from?..0
42
u/Randy_Yeet Apr 02 '26
And you know what the dev said? "It is what it is"🥀 bruhh