Disguising malware as images
A regular photo always has a .jpg or .png format and opens instantly inside the chat window. If a file prompts you to click an "Install" button or has an .apk extension, it is an executable Trojan program designed to gain hidden access to read incoming bank notifications and autofill forms.
What to do if you receive such a file
- never click on the message and immediately delete the suspicious chat
- disable the "Auto-download files" setting in Telegram for mobile data and Wi-Fi
- check your phone's system settings to ensure installing apps from unknown sources is blocked
- immediately enable Airplane mode and run an antivirus scan if the file has already been launched