In short: On 5 August 2026 a researcher described a new way to deanonymize Telegram users on Android: tapping an innocent-looking link or username silently launches an embedded Mini App, and its owner receives your IP address, device make and model, Telegram version and built-in account data — name, username, interface language and Premium status. Your messages stay encrypted, but your identity and rough location can leak in a single tap. A network-level defense such as a VPN hides the IP; nothing but caution protects the account fields.
What happened
The author of the Chekist42 channel published a technique that abuses Telegram's startapp parameter — the mechanism normally used to open Mini Apps. On Android, tapping a link or even a username that is secretly wired to a Mini App opens the target page inside Telegram's embedded WebView without any warning. The attacker never sees the message contents, but the web app they control immediately learns who opened it. The report was tied to a bug-bounty payout of about $100, which the researcher called far too low for a privacy issue of this scale. If you want to understand the underlying exposure first, our guide on how to hide and change your IP address covers the basics.
What data leaks
Because the Mini App runs in a real browser context and receives Telegram's authorization payload, a single tap can hand over a surprising amount:
- Your real IP address — enough to approximate your city and identify your internet provider.
- Device fingerprint — the User-Agent string reveals the Telegram version, phone manufacturer and model, Android version, SDK level and a device performance class, plus screen resolution.
- Account data — the Mini App gets Telegram's built-in authentication fields: account ID, first and last name, username, interface language, Premium status and a link to your profile photo.
Taken together, that is not an anonymous ping — it ties a real network location to a named account.
Is this the same as the earlier proxy-link leak?
No, but it rhymes. Back in January 2026 researchers showed that disguised t.me/proxy links made Telegram on Android and iOS ping the proxy server automatically, exposing the user's real IP before the proxy was even added. Telegram acknowledged that any website or proxy owner can see the IP of whoever connects and promised a warning prompt for proxy links. The August Mini App method is a different vector — it leaks the account payload on top of the IP — but the lesson is the same: a link inside a messenger can quietly reach out to an attacker's server on your behalf.
What does this mean for your privacy?
For an ordinary user the risk is targeted deanonymization. Someone who wants to know who is behind an account — a stalker, a scammer building a dossier, or an operator profiling a chat's members — only has to get you to tap one crafted link or username. From your IP they get an approximate location and your provider; from the account payload they confirm exactly which account did it. That combination is what turns "an anonymous username" into "a specific person in a specific city." Telegram has previously classified this style of attack as social engineering rather than a product bug, so users should not assume a silent fix is coming.
How to protect yourself
A few practical steps close most of the exposure:
- Don't tap unknown links or usernames from strangers or public chats — that tap is the whole attack. Treat a link that opens "a bot" or "a mini app" you didn't ask for as suspicious.
- Keep Telegram updated from the official store so you get any client-side hardening as soon as it ships.
- Minimize what your account exposes — a generic username and a locked-down profile reduce what a Mini App can read. See our guide on protecting your Telegram account.
- Hide the network layer. A no-logs VPN replaces your real IP with the server's, so even when a Mini App or a proxy check reads your address it sees the VPN endpoint — not your home or mobile IP. It does not hide the account fields, which is exactly why caution and a VPN are separate, complementary layers. The same logic explains a related desktop risk: a WebRTC leak can reveal your real IP in a browser even behind a VPN.
Encryption keeps your messages private; it was never meant to hide the fact that your app can be tricked into contacting a server. For a wider view of mobile privacy threats this year, browse the LiMP VPN blog and our plans.