Flare Research (blog dated 24 September 2026; Cyber Security News amplify 25 Sep) documents TWEAKOS, a Telegram-native credential theft and monetization workflow recovered after source appeared on Pastebin. Two co-designed Python components share one bot token and admin IDs: a Windows-oriented stealer that persists via Startup / user Run key (no admin needed), harvests Discord tokens from Discord / Discord PTB / Chrome default-profile LevelDB (.log/.ldb), validates them against Discord’s API, drives an interactive Telethon sign-in to mint a fresh Telegram .session, and exfils validated tokens/sessions to hardcoded admin IDs; plus a single-process Telegram bot backend (SQLite) that inventories victims/products/orders and sells “telegram” and “discord” accounts under the TWEAKOS brand with 5%/day time-decay pricing settled in Telegram Stars.

Flare assesses this as the first documented case of a stealer and its own storefront running inside the same bot process.

Delivery lure and victim count unknown; bot reachability at disclosure not confirmed. No CVE. Distinct from RemControl / Psychedelic Stealer desk cards. Primary: Flare; wire: Cyber Security News 25 Sep 2026.