# Telegram Remote Control Daemon Targeting Claude Code CLI (aipager)

- **Severity:** High
- **Signature ID:** `3f2c9a41-7d68-4e5b-9c1a-b8e6d02f4a37`

## Summary

A tool called aipager connects a Telegram bot to a running Claude Code CLI session, letting someone on Telegram send commands to that session remotely. This detection catches it being installed, started, or built by hand.

## How the attack works

An attacker either installs the aipager package directly (via pip, npm, npx, pipx, etc.) and runs it in daemon/bot mode, or assembles the same capability manually by combining Telegram bot credentials with a command that attaches to a detached Claude Code session (using dtach, tmux, or screen). Once wired together, messages sent to the Telegram bot are relayed into the live Claude Code session, giving the operator a remote shell into the agent without needing direct access to the machine. The detection only fires when both the Telegram piece and the session-attach piece appear together in the same command — either alone is normal developer tooling.

## Why it matters

An attacker gains a persistent, hard-to-notice remote control channel into an active AI coding session, letting them run commands, read code, or exfiltrate data through a channel that looks like a routine notification bot.

## What you can do

- Audit hosts and CI environments for the aipager package and remove it unless explicitly approved.
- Review any command lines combining Telegram bot tokens with dtach/tmux/screen session attachment — treat this combination as suspicious by default.
- Restrict outbound network access from developer and agent-hosting machines to known endpoints; block unexpected connections to api.telegram.org where not required.
- Rotate any Telegram bot tokens found in scripts, environment variables, or shell history, and check whether they were used from an unexpected IP or time.

## Known benign look-alikes

- Developer legitimately evaluating or removing the aipager package (suppressed by filter_inspection - pip show/uninstall, npm view, --help, which, grep).
- Security team documenting this threat in a README, advisory or threat model, or an agent writing a markdown/rst report that quotes the aipager invocation (suppressed by filter_docs).
- CI pipelines and unit tests that assert on the aipager command string or use a placeholder Telegram token such as 123456789:AAxxxxxxxx (suppressed by filter_test and filter_placeholder).
- An in-house build/notify script that posts to api.telegram.org AND separately manages a dtach session in the same long composite command line - the Telegram half and the session-control half must co-occur in one event to match, so this is the main residual FP. Reviewed as report-only for that reason.
- Approved internal "Claude Code over chat" bridges built on Telegram; these are a true positive for this detection by design and should be triaged as policy exceptions, not silenced by widening the pattern.

## References

- https://owasp.org/Top10/A01_2021-Broken_Access_Control/
- https://owasp.org/Top10/A04_2021-Insecure_Design/
- https://attack.mitre.org/techniques/T1219/
- https://attack.mitre.org/techniques/T1102/
- https://attack.mitre.org/techniques/T1546/

---
Source: https://www.netzilo.com/threats/aipager-telegram-remote-control