Some infostealers use Telegram’s Bot API to send stolen credentials and system information to their operators. This October 2024 article examines logs obtained directly from those bots and the visibility they provide into the infostealer ecosystem.
The published team dataset contained about five million logs from approximately 1,800 bots, with parsers covering 27 infostealer families. Collection began in October 2024, while timestamps in the records reached back to 2020 and were mostly from 2022 onward.
These are log records, not a count of unique victims. The findings describe the collected bots and available records; they do not measure the entire infostealer population.