“When the user receives a message through the trojanized app, the spyware sends a copy straight to the operator’s command and control (C2) server”
The clones targeted Chinese-speaking users and Uighurs and promised a “faster” Telegram. Kaspersky reported them, and several were still on Google Play when the report went out. The package names differed from the real one by a single letter. Google’s statement credits Play Protect for keeping users safe after 60,000 installs.