Telegram Remote Control Daemon Targeting Claude Code CLI (aipager)

How the attack works

An attacker either installs the aipager package directly (via pip, npm, npx, pipx, etc.) and runs it in daemon/bot mode, or assembles the same capability manually by combining Telegram bot credentials with a command that attaches to a detached Claude Code session (using dtach, tmux, or screen). Once wired together, messages sent to the Telegram bot are relayed into the live Claude Code session, giving the operator a remote shell into the agent without needing direct access to the machine. The detection only fires when both the Telegram piece and the session-attach piece appear together in the same command — either alone is normal developer tooling.

Netzilo detection

Why it matters

An attacker gains a persistent, hard-to-notice remote control channel into an active AI coding session, letting them run commands, read code, or exfiltrate data through a channel that looks like a routine notification bot.

What you can do

• →Audit hosts and CI environments for the aipager package and remove it unless explicitly approved.
• →Review any command lines combining Telegram bot tokens with dtach/tmux/screen session attachment — treat this combination as suspicious by default.
• →Restrict outbound network access from developer and agent-hosting machines to known endpoints; block unexpected connections to api.telegram.org where not required.
• →Rotate any Telegram bot tokens found in scripts, environment variables, or shell history, and check whether they were used from an unexpected IP or time.

Known benign look-alikes

• Developer legitimately evaluating or removing the aipager package (suppressed by filter_inspection - pip show/uninstall, npm view, --help, which, grep).
• Security team documenting this threat in a README, advisory or threat model, or an agent writing a markdown/rst report that quotes the aipager invocation (suppressed by filter_docs).
• CI pipelines and unit tests that assert on the aipager command string or use a placeholder Telegram token such as 123456789:AAxxxxxxxx (suppressed by filter_test and filter_placeholder).
• An in-house build/notify script that posts to api.telegram.org AND separately manages a dtach session in the same long composite command line - the Telegram half and the session-control half must co-occur in one event to match, so this is the main residual FP. Reviewed as report-only for that reason.
• Approved internal "Claude Code over chat" bridges built on Telegram; these are a true positive for this detection by design and should be triaged as policy exceptions, not silenced by widening the pattern.

References

• https://owasp.org/Top10/A01_2021-Broken_Access_Control/
• https://owasp.org/Top10/A04_2021-Insecure_Design/
• https://attack.mitre.org/techniques/T1219/
• https://attack.mitre.org/techniques/T1102/
• https://attack.mitre.org/techniques/T1546/