Watch for unusual traffic to Telegram servers from devices that do not have the app installed.

The malware grants attackers nearly full control over a victim's machine:

Deploys keyloggers to record every keystroke. How the Attack Works Bot Creation: Attackers create a dedicated Telegram bot.

Can delete, transfer, or encrypt files for ransom (AES-256 encryption).

For further technical details, researchers at Check Point Research and The Hacker News have published comprehensive analyses of this threat. ToxicEye RAT hits Telegram app to spy, steal user data

Look for the file path C:\Users\ToxicEye\rat.exe on your system.

Steals credentials, browser history, cookies, and clipboard contents.