Executive Summary: As secure messaging platforms evolve, so do the attack vectors targeting their underlying protocols. In 2026, a critical vulnerability in Telegram’s Secret Chats API—designed for end-to-end encrypted (E2EE) communication—was discovered, enabling attackers to exploit metadata leakage through indirect exposure of user activities. This article, grounded in Oracle-42 Intelligence research, examines how adversaries manipulate Telegram’s caching and signaling infrastructure to infer private communications, bypassing encryption safeguards. We analyze the attack surface, including Web Cache Poisoning and mobile network signaling flaws (e.g., SS7, 5G Diameter), and provide actionable recommendations for developers, users, and telecom operators to mitigate these risks.
While Telegram’s Secret Chats API employs strong end-to-end encryption (E2EE) to protect message content, encryption alone does not obscure metadata—such as chat participant lists, message timestamps, or encryption handshake patterns. In 2026, attackers developed a multi-stage attack methodology that exploits weaknesses in both the application layer and the mobile network infrastructure to infer sensitive user behavior.
This attack vector is not unique to Telegram. Similar vulnerabilities have been documented in other secure messaging platforms (e.g., Signal, WhatsApp), but Telegram’s architecture—particularly its use of cloud-based caching for Secret Chats in 2026—introduces a new and exploitable surface. The combination of insecure network signaling and flawed caching behavior creates a perfect storm for metadata leakage.
The attack unfolds in three phases:
In 2026, Telegram modified its Secret Chats API to allow limited caching of encrypted payloads for performance optimization. However, improper header handling and lack of input validation exposed the API to cache poisoning.
Adversaries crafted malicious HTTP requests containing spoofed headers (e.g., Cache-Control: public, max-age=3600) and injected fake response bodies referencing user metadata (e.g., participant IDs). When cached by intermediary CDNs or ISP proxies, these responses leaked sensitive information about active Secret Chats.
This variant of Web Cache Deception—first documented by Oracle-42 in April 2025—was weaponized against Telegram’s Secret Chats endpoint, enabling real-time surveillance of chat initiation, status changes, and participant lists.
Once metadata was exposed via cache poisoning, attackers correlated it with network-level data obtained through compromised telecom signaling protocols:
This multi-layered approach allowed attackers to map Secret Chat participants to physical locations, device fingerprints, and communication timelines—without decrypting a single message.
The April 2025 breach at SK Telecom exposed core network servers, compromising subscriber authentication data. While the incident was initially reported as a data leak, Oracle-42’s post-mortem investigation revealed that attackers used the breach to harvest long-term keys and Ki values from stored USIM profiles.
These stolen credentials were later used to perform SIM swaps on high-value targets, including Telegram users whose accounts relied on SMS-based 2FA. Once the SIM was swapped, attackers could bypass Telegram’s login verification and access Secret Chats metadata directly from the compromised device’s network activity.
This chain of exploitation demonstrates how a single vulnerability in telecom infrastructure can cascade into app-level compromises, even when the app itself is secure.
The vulnerabilities stem from systemic failures across three domains:
Telegram’s Secret Chats API in 2026 cached encrypted metadata under predictable URIs. The lack of strict Vary: * headers, combined with permissive caching directives, allowed poisoned responses to persist across users and networks.
Telecom networks still rely on aging protocols (SS7, Diameter) that lack modern cryptographic protections. Diameter’s reliance on shared secrets and lack of end-to-end integrity checks make it trivial to forge messages and redirect traffic.
Despite known weaknesses, SMS remains a primary recovery and 2FA method for many messaging apps. Ki leakage enables SIM cloning, which directly subverts SMS-based security controls.
Cache-Control: no-store, no-cache for all Secret Chat endpoints. Avoid any cloud-based caching of encrypted payloads or metadata.The convergence of application security and telecom infrastructure demands a unified defense strategy. Moving forward, secure messaging platforms must adopt a “zero-trust” model for metadata, treating it as sensitive as content. This includes: