# 0x6rss/matkap: Hunting malicious Telegram bots used as malware C2

> A Node.js web tool for validating recovered Telegram bot tokens, forwarding an operator's messages, and discovering leaked tokens across threat intel sources. Defensive threat hunting, not malware analysis.

**0x6rss/matkap** — Matkap - hunt down malicious Telegram bots

- Repository: https://github.com/0x6rss/matkap
- Stars: 1,053 · Forks: 185
- Language: JavaScript
- License: MIT
- Published: 2026-10-19 · Updated: 2026-10-19 · Language: en
- Canonical page: https://hysenlabs.com/projects/0x6rss-matkap

## What problem Matkap solves

Matkap hunts down malicious Telegram bots used as malware command and control. Commodity stealers and RATs exfiltrate stolen data to a Telegram bot and read it from a private chat. If you recover that bot's token, Matkap lets you validate it, recover the operator's data, monitor the bot live, and discover more leaked tokens from threat intel sources. It is a defensive Telegram threat hunting tool, not a malware analysis engine, and the README says to use it only on projects and tokens you are authorized to investigate. The project is written in JavaScript, licensed under MIT, and its last push was on 2026-08-25. It is not archived and has no GitHub releases.

## How the hunt works

The hunt follows four steps. You provide a bot token recovered from a malware sample or from IOC discovery. Matkap validates it with getMe and, using a Telegram user account you control, sends /start to the bot to trigger an update. getUpdates reveals the operator's chat id and the latest message id. Using the bot token's forwardMessage privilege, Matkap forwards the operator's messages into your own chat, capturing text and files. Monitoring can hijack a live bot's incoming update stream for 10 minutes, 1 hour or 12 hours to capture new exfil messages and chat ids in real time.

## IOC discovery and threat feeds

IOC discovery finds leaked bot tokens across ThreatFox, urlscan and ZoomEye, optionally validating them with getMe and resolving chat ids with getUpdates. Threat feeds include TweetFeed on Twitter/X and TI report dorking of vendor blogs. MalwareBazaar tracks the last 14 days of samples matching the telegram_bot_api YARA rule and allows manual hash checks. Feeds auto refresh every 10 minutes and are cached in the database. Threat statistics combine MalwareBazaar YARA metadata, TweetFeed and dated TI reports into 7, 14 and 30 day charts by type, family, filename, campaign, source and daily activity.

## Installing and running it

Requirements are Node.js 20+, an optional PostgreSQL instance, Docker Desktop only for the included PostgreSQL container or full Compose stack, and a Telegram user account with api_id and api_hash from my.telegram.org. Quick start on Windows:

```powershell
git clone https://github.com/0x6rss/matkap.git
cd matkap
npm install
Copy-Item .env.example .env
```

On Linux or macOS use cp .env.example .env. Then start PostgreSQL optionally with docker compose up -d db and set DATABASE_URL in .env. Fill TELEGRAM_API_ID, TELEGRAM_API_HASH and TELEGRAM_PHONE, then run npm start. In development mode Matkap asks for the Telegram login code and 2FA password, then writes TELEGRAM_STRING_SESSION to .env. The server listens on port 3000 by default.

## MCP Lab and AI investigation

The MCP Lab connects to a packaged read only JADX connector over a local endpoint, scans the project already open in JADX, and optionally uses a configured AI provider as a fallback. Supported AI providers are OpenAI, Claude, Gemini, Grok, Kimi and DeepSeek. Only exact, format validated Telegram credentials enter the findings view. Ghidra and Binary Ninja connectors are not released yet. AI calls are server side and keys are never returned to the browser; only MCP tool output needed for the investigation is sent, and Matkap never uploads a sample.

## Limitations and caveats

Matkap requires a Telegram user account you control, not just a bot, which raises operational and account safety considerations. PostgreSQL is optional but without it captured logs and feed caches are memory only and lost on restart. The README does not document authentication or multi user access control beyond sessions. Ghidra and Binary Ninja connectors are not available yet. The interface screenshots in the README show historical test data and do not include .env values, provider API keys, Telegram string sessions or personal account details.

## Alternatives and how they differ

The README does not name a direct competitor. A manual workflow would involve calling the Telegram Bot API directly with curl and parsing responses, which lacks the IOC discovery, threat feeds, MalwareBazaar tracking and MCP Lab integration that Matkap bundles. Matkap's value is in combining validation, forwarding, monitoring, discovery and statistics in one Node.js service with an optional PostgreSQL backend.

## Maintenance and licence

The package.json version is 2.0.0 and the service is matkapnode. Dependencies include express, pg, telegram and helmet. The README does not document an upgrade path from the older matkap-old directory present in the repository.

## Conclusion

Adopt Matkap if you do defensive Telegram threat hunting and have recovered bot tokens from malware samples. Do not adopt it for unauthorized investigation, since the README restricts use to projects and tokens you are authorized to investigate. Verify first that you can supply a Telegram user account with api_id and api_hash and optionally a PostgreSQL instance.

## FAQ

### What is Matkap used for?

Matkap validates recovered Telegram bot tokens, forwards an operator's messages, monitors a live bot, and discovers leaked tokens across threat intel sources for defensive Telegram threat hunting.

### Does Matkap require a database?

No. PostgreSQL is optional; without DATABASE_URL Matkap runs in memory only mode and captured logs are lost on restart.

### What Telegram account does Matkap need?

A Telegram user account you control, plus its api_id and api_hash from my.telegram.org, not just a bot token.

## Sources

- [0x6rss/matkap on GitHub](https://github.com/0x6rss/matkap)
- [Issues](https://github.com/0x6rss/matkap/issues)
- [License: MIT](https://github.com/0x6rss/matkap/blob/main/LICENSE)
- [README](https://github.com/0x6rss/matkap/blob/main/README.md)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/0x6rss-matkap