Saint EvilLoader, the Video That Wasn't

Patron of disguised attachments, messaging apps, and anyone who taps "open in browser".

Life

On 4 March 2025 researcher 0x6rss described EvilLoader, heir to EvilVideo (CVE-2024-7014). On Telegram for Android an HTML file was shown with the name and look of a video; whoever tried to play it got an error and the suggestion to open it in a browser, where the hidden code sprang into action. According to reports at the time, the exploit was for sale on underground forums.

Prayer

O Saint EvilLoader, who promises a video and delivers a page, teach us to distrust the attachment that insists. Amen.

How to celebrate

Celebrated by keeping Telegram updated, disabling installs from unknown sources, and not opening in a browser the "videos" that ask for it.

A video that asks for the browser is no video at all.