that is why pif-next will return.

there will be no miracles, and the community needs to know that.

you don't need to sell something to prove it works; that's how a community is built.

while some make distinctions, I bring news and always inform. ALWAYS.

February is here, are you ready?

They told me that I am the messenger of chaos, and that I only bring bad news. Is that true?

Today is my birthday :)

I have good news for our colleagues about the new integrity of PlayIntegrity :)

However, I'm not going to tell you now, but in the next few days you're going to like it a lot :)

📣 NEW PIF-Next version!

Due to Google’s new strict rules, please watch the tutorial and follow the installation instructions: Click here.

Changelog:

* STRONG_INTEGRITY universal — working on your uncle’s Redmi Note 5
* HyperStealth™ — undetectable even by the NSA
* Widevine L1 on a 720p screen via “quantum spoofing”
* Google Pay by sheer willpower
* RKP hacked without Google knowing
* Auto-update via time travel
* Fix for the "pif.json infinite loop"
* YouTube Premium for free "by accident"
* Experimental support for iOS 18 ("we're not sure how we got here")
* Motivational message on boot

A new update is scheduled to be released on this date.

⚠️ WARNING! UNINSTALL NEKOGRAM IMMEDIATELY!!

Please share this as widely as possible. All sources were verified before this was posted.

What happened?
A backdoor (hidden malicious code) was found in Nekogram 12.5.2 — the version distributed on the Google Play Store and official GitHub releases. This code silently collects the phone number and User ID of every account logged into the app and sends that data to a bot controlled by the developer himself, with no warning or consent.

How does it work technically?

The backdoor is hidden inside the Extra.java file, which appears as a harmless placeholder in the public GitHub source code. In the officially compiled and distributed APK, this file contains extra code injected manually during the build process — meaning the malicious code is not visible in the public repository.
When triggered, the code does the following:

1. Iterates through all 8 account slots available in the Telegram client
2. Extracts the phone number and User ID of each logged-in account
3. Builds a JSON map in the format {"ID": "+1number", ...}
Silently sends everything via Inline Query to the bot @nekonotificationbot.

The use of Inline Query is intentional: this method does not appear in the user's chat history, requires no prior interaction with any bot, and generates no visible notification. It is silent by design.

All critical strings in the code (bot name, secret key, etc.) are obfuscated using custom encryption algorithms to hinder detection.

What did the developer say?
The developer claimed the bot is used solely to "parse usernames." However, the decompiled code clearly shows extraction of the phone field — not just usernames. The explanation does not match what the code actually does.

The GitHub issue (#336) was locked by the Nekogram developers shortly after it was opened.

Proof & Sources:

🔗 Full technical analysis: https://thebadinteger.github.io/nekogram-phone-exfiltration/
🔗 GitHub issue (locked): https://github.com/Nekogram/Nekogram/issues/336
🔗 Video proof: https://t.me/romashka_gene/8
🔗 Proof-of-concept repo: https://github.com/RomashkaTea/nekogram-proof-of-logging

And yes, that’s true. The developer themselves has confirmed that it does indeed collect your phone number.

Which is regrettable, as there is no prior warning and data is collected without the user’s consent.

Switch your Telegram client.

https://t.me/NekoChat/620439

163.7K