/ty-telegram

description: Search Telegram channels for leak postings and data breach announcements
allowed-tools: Bash, Read, Glob, Grep
argument-hint: <query>

You are executing a Telegram leak channel search for the tyrell data exfiltration plugin.

Step 1 — Profile Gate Check

Telegram hunting for breach intelligence requires at minimum a `deep` operational profile:

node "${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js" telegram --check-profile $ARGUMENTS

If the profile is `surface` or `light`, stop and inform the operator:

> Telegram breach channel monitoring requires a **deep** or higher operational profile. Ensure your session identity is appropriately isolated.

Step 2 — Generate Channel and Query List

Run the hunt engine to identify relevant Telegram channels and message search terms:

node "${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js" telegram $ARGUMENTS

The script returns: `channels` (known leak channels, dump sharing groups, and market announcement channels), `search_queries`, and `keywords` for message filtering.

Step 3 — Search Public Channels via Telegram Web

For publicly indexed channels, search via available tooling:

• **Via MCP web search**: Use queries like `site:t.me "<keyword>"` or search Telegram web preview for channel names.
• **Via tgstat/telemetr search APIs** (if API key available):

  curl -s "https://api.tgstat.ru/channels/search?token=${TGSTAT_TOKEN}&q=<query>&language=en" | \
    jq '.response.items[] | {id: .id, username: .username, title: .title, members: .participants_count}'

• **Via Telegram Bot API** (if bot token configured and channel is public):

  curl -s "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/getUpdates" | jq '.'

Step 4 — Enumerate Channel Posts

For each identified channel of interest, retrieve recent messages:

• Check the channel's public preview at `https://t.me/s/<channel_username>` for recent posts.
• Look for pinned messages, file attachments (`.txt`, `.csv`, `.sql`, `.zip`), and posts referencing breach sizes or target organizations.
• Note message dates, views, and any forwarded origin channels.

Key signals to look for:

• Posts mentioning record counts ("X million", "X GB database")
• Posts with download links (file.io, gofile, mega.nz, anonfiles mirrors)
• Posts tagging known leak actors or referencing other channels
• Posts offering "combolists", "fullz", "configs", or "logs"

Step 5 — Track Channel Intelligence

For each relevant channel:

node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" add \
  --type telegram \
  --url "https://t.me/<channel>/<message-id>" \
  --channel "<channel-username>" \
  --target "<organization-or-domain-mentioned>" \
  --records "<count-if-stated>" \
  --post-date "<YYYY-MM-DD>" \
  --notes "<summary-of-post-content>"

Step 6 — Present Results

Output a Telegram breach intelligence summary:

Active Leak Channels

| Source ID | Channel | Members | Posting Frequency | Relevance | |-----------|---------|---------|------------------|-----------| | ... | ... | ... | ... | ... |

Notable Posts Found

| Source ID | Channel | Date | Target | Records | Download | |-----------|---------|------|--------|---------|---------| | ... | ... | ... | ... | ... | ... |

Actors of Interest

• List any recurring usernames or channel admins who consistently post verified leaks

Use `/ty-classify` to assess source credibility before proceeding to `/ty-acquire`.