In September 2020, it had been described that Iran's RampantKitten espionage team ran a phishing and surveillance marketing campaign against dissidents on Telegram.[362] The attack relied on folks downloading a malware-infected file from any supply, at which place it could replace Telegram files within the system and 'clone' session https://www.telegramkko.com/