In September 2020, it had been claimed that Iran's RampantKitten espionage group ran a phishing and surveillance campaign in opposition to dissidents on Telegram.[356] The assault relied on people downloading a malware-infected file from any source, at which level it will swap Telegram data files on the device and 'clone' session info.Edit: this is