Telegram RegisterThe public register of Telegram
Telegram profile photo for Android Security & Malware

Channel

Android Security & Malware

@androidMalware

On this record: Topic · Observations · Channels linked by matching posts · Growth · Engagement · What this channel posts · Reactions · Posts · Citations · Telegram's recommendations · Cite this entry

44,494subscribers

-344 since we began measuring on 6 August 2026

Risers and fallers across the register · movement among entries of 31,623–100,000.

Register entry

Telegram ID-1001164747047
TypeChannel
Username@androidMalware
Created2 May 2019 — measured — cross-checked against a third-party dataset (ext.tg_channel)
First recorded6 August 2026
Last confirmed live11 November 2026
Measurements held65
Confirmed unchanged1 time, most recently 11 November 2026
On Telegramt.me/androidMalware

Topic

Hacking & security — a classification, not a measurement. An on-box language model (Qwen3.6-35B-A3B-UD-Q6_K_XL, prompt version 1) read this channel’s own recent posts on 20 August 2026 and assigned it the closest of 31 fixed categories, at 97% confidence. This is a model’s judgement about what the channel is likely to be about, not a fact this register measured the way a subscriber count or a view count is measured — it can be revised on a later pass, and it carries no weight anywhere else on this page. How this classification works, and the other topics.

Observations

These are measurements, not verdicts. Each one below states something we counted, alongside the evidence it was counted from, so you can check it rather than take it. None of them is graded: every observation this register holds is recorded at severity 0, because the precision of the detectors behind them has not been measured yet, and a rating we cannot support is worse than none. Read each as a fact about the data, not as a judgement about the channel. How we measure.

Content that also appears on other registered channels

Posts published here appear in near-verbatim form on 1 other registered channel. This entry also sits inside a group of 3 channels linked by matching posts, directly or through other channels in the group; two members of the group may share no posts with each other. The matching is on the text itself, not on Telegram’s forward marker, so it finds a copy whether or not it was labelled as one.

Matching posts — open both and compare (6 of the pairs behind the counts below)
Posted firstThenOverlapGap
@ThreatServer/330611 Jul 2026, 14:10 UTC@androidMalware/2937 · this entry14 Jul 2026, 13:41 UTC1.003 days
@androidMalware/2938 · this entry15 Jul 2026, 14:53 UTC@ThreatServer/330918 Jul 2026, 11:00 UTC1.003 days
@androidMalware/2939 · this entry24 Jul 2026, 07:28 UTC@ThreatServer/331225 Jul 2026, 01:13 UTC1.0018 hours
@androidMalware/2940 · this entry29 Jul 2026, 13:50 UTC@ThreatServer/33131 Aug 2026, 00:03 UTC1.002 days
@androidMalware/2941 · this entry30 Jul 2026, 08:25 UTC@ThreatServer/33141 Aug 2026, 00:03 UTC1.0040 hours
@androidMalware/2942 · this entry3 Aug 2026, 04:32 UTC@ThreatServer/33154 Aug 2026, 00:43 UTC1.0020 hours
Channels this entry shares post bodies with, where at least one matching post pair has no forward credit between the two channels, or to a common source, recorded in our data
ChannelMatching postsText overlapTypical gapPublished first
@ThreatServer8 (8/8 hand-verifiable sample passed)1.0043 hoursthis entry (7–1)

Text overlap is the Jaccard coefficient over the set of distinct three-word phrases in the two bodies: 1.00 is identical wording, and the threshold for counting a pair at all is 0.70. Candidates are generated by simhash LSH (4 x 16-bit bands, exact Hamming <= 3) verified against the bodies with Jaccard over the SET of distinct 3-word shingles. Published first counts which side of each matching pair carries the earlier timestamp — in this corpus, which is the limitation directly below.

What this cannot establish

MEASURED, DOMINANT ERROR SOURCE: a post ingested before 2026-08-06 may have carried a forward header that was not recorded. A 45-pair hand-check against live t.me pages found 14 (31%) where the live page shows a forward header naming the other channel and the database has none, plus 4 more (9%) naming a third party. The text match itself was wrong 0 times out of 45. Read attribution_capture.items_in_trusted_window before treating the unattributed count as a claim.

Telegram lets a channel forward a post with a header naming the source, and we only began reliably recording that header on 2026-08-06. None of the 0 matches recorded here fall after that date, so for this entry we cannot say whether any of them carried a credit. The duplication is measured; the absence of attribution is not.

“Published first” means first in this corpus. We hold 38 comparable posts for this entry, running 9 June 2026 to 22 August 2026. A channel we have read one page deep will look younger than a neighbour we have read in full, and the order would flip with no change in the underlying facts.

The detector’s own notes on this observation, as it recorded them. Names in this_style are fields of the underlying evidence record, which the plain-English paragraphs above read out for this entry.

  • Verbatim republication has three causes and the text separates only two: a clone/mirror, unattributed copy-paste, or BOTH channels copying a common third source that neither attributes. The spread filter (content held by at most 8 channels) reduces the third and does not remove it.
  • 'Earliest' means earliest IN THIS CORPUS. A channel ingested one page deep will look younger than a neighbour ingested in full; corpus_coverage above is there to be checked before the direction is believed.
  • shared_verified_est extrapolates the sampled pass rate over the full narrow match count; sampled/passed are the numbers actually measured.
  • Absence of a forward header is not proof of intent: Telegram lets a channel disable forward attribution, and a credit written in the body is not parsed as attribution here (mention_edge_either_way above is the closest available signal).

Of the group of 3 channels, the one whose matching posts we hold earliest is @thebugbountyhunter. That channel is not among the channels listed above, so this entry may share no posts with it and this does not say where this entry’s content came from. It is a statement about our reading window, not a claim of authorship.

Recorded under the key clone_source, last confirmed 11 November 2026. An observation that a later pass no longer finds is cleared, and a cleared observation is removed from this page rather than being shown struck through — we do not keep publishing a claim we have withdrawn. Dispute an observation.

Channels linked by matching posts

This channel is in a group of 3 registered channels linked by matching posts, directly or through other channels in the group. This channel may share no posts with some of the channels listed below, and listed channels may share none with each other. Links are found by comparing text fingerprints across every channel on the register.

Which channel, if either, published first is deliberately not shown in this list. “First” could only mean first in our own crawl, which depends on how deep we happened to reach into each channel’s history, not on when the content was actually first posted. Our one hand-check read 45 of the highest-confidence flagged pairs against the live Telegram pages. In 18 of them the live page showed a “Forwarded from” credit that our database had no record of, so reading that pair as an unattributed copy was wrong; the check did not measure who published first. This list is ordered by subscriber count, the same as every other listing on this site, never by which channel we think came first. Near-verbatim matching has several ordinary explanations besides copying — a channel mirroring itself, an unattributed repost, or two channels independently repeating the same wire story — and this measurement cannot tell those apart. How this is measured.

Growth

44,49445,09644,7956 August 202611 November 2026
65 measurements spanning 98 days, net -344. Dots are measurements; the straight line between them is drawn to join them, not to claim we know the path taken in between — snapshots are recorded only when a count changes, so gaps mean “no change observed”, never “interpolated”. The vertical axis spans 44,404–45,186 and does not start at zero.
Measurement log — every subscribers count we have recorded, most recent 20 of 65
Measured (UTC)SubscribersChange
11 Nov 2026, 18:2144,494-16
9 Nov 2026, 19:4644,510-13
8 Nov 2026, 13:1544,523-8
7 Nov 2026, 04:0744,531-10
6 Nov 2026, 00:3744,541-8
5 Nov 2026, 03:3744,549-9
4 Nov 2026, 05:4744,558-10
3 Nov 2026, 04:1944,568+6
2 Nov 2026, 06:4944,562-8
1 Nov 2026, 03:0644,570-8
31 Oct 2026, 05:2644,578-8
30 Oct 2026, 05:2044,586-2
29 Oct 2026, 07:3944,588-6
28 Oct 2026, 04:1844,594-11
27 Oct 2026, 01:3844,605-6
26 Oct 2026, 00:1644,611-6
25 Oct 2026, 02:2544,617-4
23 Oct 2026, 23:2644,621-7
23 Oct 2026, 02:1744,628-9
22 Oct 2026, 01:1144,637first reading

Engagement

41 posts held, back to 9 June 2026 — the reader has not yet reached the start of this channel’s public history, so older posts may sit further back, unread. Read across 45 pages of Telegram’s post history, 20 posts per page.

Nothing published in the last 30 days. ERR and ER are rolling 30-day measures, so there is nothing to compute — we hold 41 posts for this entry, the most recent from 22 August 2026. An engagement rate over an empty window would be a number about nothing.

What this channel posts

Video runtime
1m 00s
Average length
1m 00s

Measured directly from 1 video with a duration reading, out of the posts we hold for this channel — not this channel’s whole posting history, only the sample this register has actually read. An exact reading to the second, taken from the post itself rather than from Telegram’s own rounded chrome, so it carries no ≈ mark.

Reaction mix

1,427 reactions across 38 posts, in 23 distinct kinds. The most used accounts for 31.2% of them.

Every reaction kind recorded on the sample, most used first
ReactionCountShareShare, drawn
❤44531.2%
👍38126.7%
🔥21014.7%
⚡996.94%
😁473.29%
😱372.59%
👎362.52%
🎃342.38%
👏322.24%
💯151.05%
👻140.981%
🤡130.911%
🤔120.841%
🤣120.841%
👀80.561%
😎80.561%
🥱70.491%
💩60.42%
😇30.21%
😭30.21%
3 further kinds50.35%

No sentiment is inferred, and none should be read in. This table is ordered by count and by nothing else. Emoji do not carry stable meaning across languages or communities — 🙏 is thanks in one channel and mourning in another — so we publish which ones were pressed and how often, and pass no judgement on what an audience meant by them.

Precision. Telegram publishes reaction counts per emoji and short-forms each one — 4.34K, 1.2M — so any single kind at or above 1,000 reaches us at three significant figures, and only counts below 1,000 are exact. The shares above are ratios of those figures and carry the same error. This is also why the total here can differ slightly from a reaction total printed elsewhere on the page: both are sums of the same rounded parts, taken over samples with different edges.

Coverage. Reactions were read on 41 of the 41 sampled posts in this sample. Summed by Telegram’s own count on each post — not by adding up the per-emoji breakdown above — those same posts carry 1,534 reactions in total: the kind of figure the paragraph above means by “a reaction total printed elsewhere on the page”.

Measured over the 41 most recent posts we hold, published 9 June 2026 to 22 August 2026, using the newest reading held for each. Telegram Stars are excluded: they are a payment, not a reaction, and they have their own section.

Recent posts

22 Aug 2026, 05:02 UTC≈2,770 views9 reactionsread 27 August 2026

Mesh network cache poisoning: exploiting BitChat's BLE authentication Blog: https://barghest.asia/blog/bitchat-cache-poisoning/ PoC: https://github.com/BARGHEST-ngo/PoC_Bitchat1.15.0_iOS-BLEcache-poisoning

👍5🔥3❤1

21 Aug 2026, 14:23 UTC≈3,010 views5 reactionsread 27 August 2026

Malware targeting Android-based automotive head units spread through built-in firmware updates (botnet proxy malware) https://securelist.com/android-head-unit-malware/121106/

👍5

21 Aug 2026, 09:35 UTC≈3,020 views10 reactionsread 27 August 2026

Manic: Blend between Banking Malware & Spyware https://www.threatfabric.com/blogs/manic-blend-between-banking-malware-and-spyware

❤8👍2

21 Aug 2026, 06:17 UTC≈3,010 views11 reactionsread 27 August 2026

GhostBat RAT: 78 Victims, One Lazy Key, and a Firebase Named After India’s Ruling Party https://medium.com/@singhbkn07/78-victims-one-lazy-key-and-a-firebase-named-after-indias-ruling-party-62cf0ad0380e

❤9👍2

20 Aug 2026, 12:53 UTC≈3,550 views13 reactionsread 27 August 2026

Can Someone Secretly Scan Your Payment and Access Card? I Tested It Blog: https://www.mobile-hacker.com/2026/08/20/how-easy-is-it-to-scan-a-contactless-payment-and-access-card/ Video: https://youtu.be/pwzMFQLrTHU

👍7❤3🗿2👀1

20 Aug 2026, 08:42 UTC≈3,130 views11 reactionsread 27 August 2026

ToxicPanda 2.0, a Significantly More Powerful Android Banking Trojan https://zimperium.com/blog/the-toxicpanda-never-sleeps-toxicpanda-2.0-prepares-its-next-strike-on-mobile

❤9✍1🎃1

19 Aug 2026, 15:53 UTC≈3,720 views17 reactionsread 27 August 2026

Porting ghostlock (CVE-2026-43499) to the Samsung Galaxy A17: KDP, DEFEX, and the art of not panicking https://www.mobilehackinglab.com/blog/cve-2026-43499-ghostlock-a17-root-shell

👻14⚡2❤1

18 Aug 2026, 05:45 UTC≈4,730 views14 reactionsread 27 August 2026

A critical vulnerability has been identified that allows arbitrary code execution with kernel privileges affecting Xiaomi Redmi A5 and Motorola E13 devices requiring only the ability to place a video call https://ssd-disclosure.com/unisoc-t612-lpe/

👍11😁3

18 Aug 2026, 04:33 UTC≈3,970 views7 reactionsread 27 August 2026

Revealed: Cyber spies used malware from GitHub to hack EncroChat cryptophone network https://www.computerweekly.com/news/366649396/Revealed-Cyber-spies-used-malware-from-GitHub-to-hack-EncroChat-cryptophone-network

👍7

14 Aug 2026, 09:39 UTC≈5,210 views8 reactionsread 27 August 2026

Octagon: A New Android Bot Targeting Crypto Wallets and Banking Apps https://iverify.io/blog/octagon-android-bot-crypto-wallets-banking-apps

⚡8

13 Aug 2026, 12:31 UTC≈5,020 views13 reactionsread 27 August 2026

WindRelay paired with SpyNote RAT enables live-call fraud, combining social engineering with dual digital and physical cash-out. https://www.group-ib.com/blog/windrelay-nfc-spynote-rat-combo-fraud/

👍11😁2

12 Aug 2026, 13:04 UTC≈5,740 views26 reactionsread 27 August 2026

LSPosed module for disabling SSL certificate pinning on Android https://github.com/0xdad0/ssl-kill-switch-lsposed

❤19⚡7

Showing the 12 most recent of 41 posts we hold for @androidMalware. View and reaction counts are the latest single reading for each post, not a live figure, and a recent post is still accumulating both. A view count marked ≈ was rounded by Telegram before we ever saw it — t.me prints views in full below 1,000 and to three significant figures above, so ≈1,200,000 means somewhere between 1,150,000 and 1,249,999. Unmarked counts are exact. Text is reproduced from the public post preview and truncated for length.

Forward network

Republishes

Channels on the register whose posts this channel has forwarded.

Built only from forwarded posts we have actually read, on both sides. Coverage is early and deliberately incomplete: a missing link means we have not read the post that would prove it, never that the relationship does not exist. Counts are distinct forwarded posts observed, so they only ever go up as we read more.

Mentions

Named by 2 registered channels — every channel on the register whose own posts have named this one, by its current username or any other username it currently holds, merged from two separately captured readings of the same fact so a namer caught by only one of them is not missed and a namer both caught is not counted twice. A username this channel has since dropped is not matched — that handle may belong to someone else now, and crediting today’s namer to yesterday’s owner would misattribute it.

Named by

Channels on the register whose posts name this channel's handle.

A mention is a weaker signal than a forward and is counted separately for that reason — naming a channel is not republishing it, and a handle in a post body is easy to place deliberately. The post counts beside each row below are distinct posts in which the handle appeared, from posts we have read on both sides — the “Named by N registered channels” figure above is a different count, of distinct NAMING CHANNELS rather than posts, and is not the sum of the rows under it.

Appears in Telegram’s recommendations for other channels

The reverse of the list above, and a different kind of signal. This does not require this channel to have ever been asked about directly — each row below is a channel we DID ask Telegram about, whose Telegram-generated list happened to include this one. A channel can appear here with an empty list above it, because being named by someone else’s query is independent of having been queried itself.

The Bug Bounty Hunter
@thebugbountyhunter · 52,192
Telegram ranks this channel #6 of 60 here — alongside 59 others — read 25 August 2026
Cyber Security News
@Cyber_Security_Channel · 57,266
Telegram ranks this channel #6 of 71 here — alongside 70 others — read 23 August 2026
vx-underground
@vxunderground · 52,872
Telegram ranks this channel #11 of 41 here — alongside 40 others — read 24 August 2026
The Hacker News
@thehackernews · 165,587
Telegram ranks this channel #11 of 58 here — alongside 57 others — read 13 August 2026
Computer Science and Programming
@computer_science_and_programming · 138,623
Telegram ranks this channel #42 of 87 here — alongside 86 others — read 13 August 2026
Linuxgram 🐧
@linuxgram · 72,399
Telegram ranks this channel #59 of 90 here — alongside 89 others — read 19 August 2026

This channel appears in 6 seed channels' Telegram-generated recommendation lists in total. Each is Telegram’s list for THAT channel, not this one — see how this is measured.

Cite this entry

A live page changes as we take new readings, so a citation should name the measurement it is based on, not just the URL. The line below cites the subscriber count as measured 11 November 2026 — this entry's latest reading, not the date you are reading this.

“Android Security & Malware” (@androidMalware), 44,494 subscribers as measured 11 November 2026. Telegram Register, tgregister.com/channel/androidMalware.

Full measurement history, CC BY 4.0. Every reading this register holds for this entry, not just the latest one, as a dated, downloadable record: CSV · JSON. Free to use with attribution to tgregister.com. Each file carries its own generation timestamp, which is the figure to cite for exactly when the data was retrieved.