Answered unknown call on Telegram recently? You might get hacked, do this to stay safe
Follow UsA reported Telegram Android vulnerability could allow attackers to compromise phones through calls.
The flaw reportedly affected Telegram Android versions 8.6.2 to 12.10.3, with no evidence of impact on iOS, web or group calls.
Telegram fixed the vulnerability in Android version 12.10.4. Users should update the app immediately.
Popular messaging service Telegram adds new features and enhancements via updates at regular intervals. But what if we say a recent update is important not for a new feature, but due to a serious security flaw that Telegram fixed recently? According to Nebu Security, a vulnerability in Telegram could lead to hacking of an Android phone if you picked up the attacker’s call. The Telegram RCE (Remote Code Execution) flaw was discovered by NebuSec Code Security, which is powered by GPT 5.4.
SurveyIn a video demo shared in an X (formerly Twitter) post, the attacked client (built by @NebuSec) calls the person on the platform after establishing a connection. When the victim answers the call, the phone icon starts moving in an unusual fashion and the message “Hacked by NEBUSEC” appears on the screen, implying a compromised state of the phone. The video of the hacking activity is posted below.
According to The Hacker News, the flaw, combined with the information-leak bug and an Android root exploit, could be used to gain full access to a smartphone, including the camera, microphone and messages. The flaw can be triggered in Telegram versions ranging from 8.6.2 to 12.10.3. As per the security startup, there is no evidence of the flaw impacting Telegram iOS or web users or group calls.
Remember when scam callers only ask for your password? Good times. Now picking up a wrong call can get you hacked. Telegram RCE discovered by NebuSec Code Security, powered by GPT-5.4. Yes, GPT-5.4. We turned a dinosaur model into a cyber powerhouse. Fixed in Telegram Android 12.10.4（7099)
— NebuSec (@nebusecurity) October 29, 2026
If a user’s call privacy settings are set to “Nobody” and they decline unknown calls, the flaw will not affect them. Plus, the cybersecurity company said the cases of the flaw being used to attack people have not been reported so far. When NebuSec reached out to Telegram, the platform reportedly acknowledged the report but did not consider the flaw to be a remote code execution vulnerability.
Telegram issued an update to fix this vulnerability
The good news is that Telegram fixed the vulnerability that could allow hackers to execute code on a phone remotely in Android version “12.10.4” last month. Telegram users must update to the latest Android version of the app from the Google Play Store as soon as possible. Meanwhile, if you see any unusual activity on your smartphone, consider changing the passwords of your accounts and reporting the matter to the relevant state authorities.
