When you click on the URL it redirects you to a page with injected code, which sends a request to Telegram servers and gets your session token. I did not try it by myself but in the Internet I found…

SystemWeakness's platform is  dedicated to cybersecurity education and awareness, offering insights into common security vulnerabilities, attack techniques, and risk mitigation strategies. Through articles, tutorials, and security advisories, SystemWeakness offers insights into securing software applications, networks, and systems from cyber threats. Readers can learn about secure coding practices, penetration testing methodologies, and incident response procedures to strengthen their cybersecurity posture and protect against cyber attacks.

System Weakness

A recent event highlights a session hijacking attack on Telegram where a malicious URL tricks users into exposing their session token. The token allows attackers to access accounts and persistently kick out legitimate sessions. The article underscores the importance of configuring Multi-Factor Authentication (MFA) to regain control of hijacked accounts. It provides practical steps to set up MFA within a critical 20-second window to thwart attackers and reset passwords securely.

Telegram session hijacking and how MFA can help you