Nekogram Caught Spying on Users Through Hidden Data Collection Code

A new investigation by security researcher Repinek is raising alarm over Nekogram, a widely used third-party Telegram client, with claims the app’s Android builds may include covert spying functionality. The report alleges that released APKs contain hidden code capable of collecting and silently transmitting sensitive user data.

The core concern isn’t just privacy, it’s trust. According to the findings, the behavior identified in compiled APKs does not exist in the project’s public source code, suggesting users may be installing something materially different from what developers publish on the Nekogram GitHub.

Repinek’s analysis shows the app can scan multiple Telegram accounts stored on a device and extract user IDs alongside associated phone numbers. The data is then packaged into a structured payload, effectively linking identities that many users intentionally keep separate.

The method of transmission is what makes the case stand out. Instead of sending data to an external server, the app reportedly uses Telegram’s own bot system. By leveraging inline bot queries, the process happens in the background with no visible messages, prompts, or user interaction.

This approach allows the activity to blend into normal app behavior. There are no obvious signs in chat history or notifications, making the alleged data transfer difficult to detect without deeper inspection.

The code tied to this behavior is heavily concealed. Obfuscated class names, encrypted strings, and runtime decryption of key values such as bot identifiers and API credentials point to deliberate attempts to hide how the system works.

Equally concerning is the absence of this logic in Nekogram’s open-source repository. Repinek suggests this could indicate code injection during the build process or the use of private components not disclosed publicly. Either scenario would represent a serious break from expected open-source transparency.

If confirmed, the scope could affect a large number of Android users, including those installing Nekogram from official distribution channels. Because the mechanism appears to run automatically, users wouldn’t need to take any action for data to be collected.

The developer behind Nekogram has not responded publicly to the allegations so far. It’s also unclear whether app store operators have begun any review of the claims.

For now, the findings remain under scrutiny. Independent verification will be key, but the report already highlights a broader issue: even open-source apps can’t be trusted at face value if the binaries users download don’t match the code they can review.

Sources

• GitHub — Repinek Research on Nekogram