Answer one Telegram call and your Android phone is hacked

Hacking an Android phone through Telegram took a single call. The victim didn't have to open anything or tap any link, just pick up. Security startup NebuSec disclosed the bug and posted a video: one phone is labeled "attacker", the other "victim". The victim accepts the call, and about half a minute in, the phone jumps to its home screen on its own, the app icons tumble down and a "HACKED BY NEBUSEC" logo appears.

The hole sat in Telegram for Android for more than four years: every version from 8.6.2 to 12.10.3, released between March 2022 and September 2026, is affected. The bug lived in the code that handles MediaState messages during a call. That's how the two apps tell each other whether the mic is muted, whether the camera is on and how the video is rotated. If a message was missing some fields, the app read memory it should never touch. All an attacker needed was an ordinary Telegram account.

The ironic part: it wasn't a team of hackers that found it, it was AI. NebuSec says the flaw was caught by its code analysis system built on OpenAI's GPT-5.4. In the post with the video, the researchers joked that they had turned "a dinosaur model" into a cyber weapon.

Telegram already fixed the flaw in version 12.10.4, released in late September, and the problem was only made public now. A review of the published source code for version 12.10.3 shows a bug that matches the description. The attack was confirmed on private calls on ARM64 Android phones. There's no proof yet that Telegram on iPhone, desktop or in group calls can be hit the same way, even though all versions share one calling library. NebuSec hasn't published a technical write-up, the flaw has no CVE number, and there are no reports of attacks on real people. What exactly an attacker could do after the call hasn't been disclosed either.

This is the second loud Telegram story in two days: the day before, another researcher showed an iPhone hack through stickers, which we covered here. The two flaws are different and unrelated.

Bottom line: open Telegram settings and check the version number at the very bottom. If it's below 12.10.4, update right now, not after the next call from a stranger.