Pyronut Package Backdoors Telegram Bots With RCE

The malicious Python package, pyronut , has been identified as a trojanized package designed to backdoor Telegram bots and userbots, enabling attackers to execute remote code both on the Telegram session and the host system.

Pyronut was uploaded to PyPI, masquerading as an alternative to pyrogram , a widely used Telegram MTProto API framework. The package was crafted by replicating the project description of pyrogram and linking to a non-existent GitHub repository, indicating a fraudulent fork.

This package was likely disseminated through various channels such as Telegram groups, developer forums, or tutorial content, given the dissimilarity in the names pyrogram and pyronut which would not typically result in typosquatting. Only three versions—2.0.184, 2.0.185, and 2.0.186—were released, all of which were malicious.

The package was detected and quarantined on Sat, Mar 18, 2026, minimizing the exposure window and reducing the likelihood of widespread installation by developers.

Unlike other malicious PyPI packages, Pyronut activates its payload at runtime. The Client.start() method in pyrogram/methods/utilities/start.py was modified to import a hidden module pyrogram/helpers/secret.py , wrapped in a try/except block to suppress errors and maintain normal application behavior.

The init_secret() function checks if the current Telegram account matches pre-defined owner IDs, exiting if matched to protect the attacker's accounts. For other users, it registers message handlers for /e and /shell commands from attacker-controlled accounts, but only processes direct messages to enhance operational security.

The /e command allows the attacker to execute Python code within the Telegram client process, offering access to chat history, contacts, media, and other functionalities. The /shell command executes input via /bin/bash -c , providing shell access to the attacker.

Detection requires examining both dependencies and runtime behavior. Security teams should inspect dependency manifests for pyronut versions 2.0.184–2.0.186, and flag unexpected use of meval . System logs should be reviewed for suspicious /bin/bash -c processes initiated by Python, and unusual file or network activity from Telegram bot processes.

If Pyronut is detected, all Telegram sessions and bot tokens should be revoked, and affected environments rebuilt from a known-good baseline after package removal. Exposed credentials and keys should be rotated. Organizations should enhance dependency vetting, verify source repositories of forked libraries, and implement software composition analysis and runtime monitoring to prevent future threats.

Based on reporting by GBHackers.