Stealing your Telegram account in 10 seconds flat

For anyone wondering: the attacker needs physical access to your unlocked device, and replaces the telegram.org URL with a telegramz.org URL. The authentication part is stored in a string after the domain name... and the attack server gets it.

Author's video demo here: https://vimeo.com/941755175

I don't get it. How could the author change the URL on my iPhone, even if it was unlocked? Manipulate the Wifi connections (like in any public place) could swap the URLs, but what about the secure handshake and certificates? Telegram doesn't use a secure connection, no end-to-end encryption or what?

This is a physical attack, the attacker edits the URL (as can be seen in the demo video).

Caveat: This will also send a notification to the target that they logged into a new device on all their devices and the mobile app will show a prominent banner that someone else has access to their chats.

I don't want to spoil the surprise, but this is worth the read just for the "twist" at the end.

Thank you for this comment! I blurted out "Wait, what? How do you do that?" when I read that bit.

Thank you! Getting to read comments like this really makes all the extra effort worth it :)

which part was the 'twist' ?