Can delete, transfer, or encrypt files for ransom (AES-256 encryption).

The malware communicates back to the attacker via the Telegram API, which often bypasses enterprise security because Telegram is seen as a "trusted" service. Signs of Infection & Protection

The bot token is embedded into the ToxicEye configuration and compiled into an executable (.exe).

Steals credentials, browser history, cookies, and clipboard contents.

For further technical details, researchers at Check Point Research and The Hacker News have published comprehensive analyses of this threat. ToxicEye RAT hits Telegram app to spy, steal user data

Hijacks the PC’s microphone and camera to record audio and video.

The malware grants attackers nearly full control over a victim's machine: