A zero-day in Telegram for Android, patched on July 11, let attackers send malicious Android APK payloads as video files; the exploit was for sale from June 6 (Bill Toulas/BleepingComputer)

Bill Toulas / BleepingComputer:
A zero-day in Telegram for Android, patched on July 11, let attackers send malicious Android APK payloads as video files; the exploit was for sale from June 6  —  A Telegram for Android zero-day vulnerability dubbed ‘EvilVideo’ allowed attackers to send malicious Android APK payloads disguised as video files.