Telegram tests Lockdown Mode for targeted attacks on macOS

Gaik Dallakian — 14.11.2026

Telegram is testing an optional Lockdown Mode in its macOS app that restricts what loads automatically and asks users to confirm before opening certain chats, links and files.

The setting appears in macOS beta version 13.2, build 283493. Telegram describes it as an extreme measure for people who may face sophisticated, targeted attacks. It’s under Settings → Privacy → Lockdown Mode, and the app asks for confirmation when users turn it on or off.

What changes with Lockdown Mode on

  • Media. Only photos sent by the user or their contacts download automatically.
  • Direct messages. An optional setting asks users to confirm before opening a chat with someone outside their contacts.
  • Links. Link previews and Instant View pages stop loading automatically.
  • Mini apps. Every launch requires confirmation, and WebKit applies stricter security controls to web content.
  • HTML widgets and stickers. Telegram hides content it considers potentially risky until the user confirms they want to load it.
  • Files. Telegram shows separate warnings before downloading and opening risky files. Users can access executables and disguised files only through Finder. The app opens images in JPEG, PNG, WebP, HEIC and GIF formats and blocks other image formats.
  • Payments. Payment pages are blocked.

In the beta, prompts to follow a link or open a chat with someone outside the user’s contacts appear in a separate window. To proceed, the user slides a control to the right.

The beta surfaced the same day Telegram’s HTML widgets stopped working following reports of security flaws. Telegram founder Pavel Durov said the reported attack required a user to start a third-party service and that Telegram had blocked that scenario on its servers.

Kaspersky later reported that it had detected attempts to deliver a remote-access trojan called WebRAT, also known as Salat Stealer, when users visited certain Telegram channels. The first attempts were recorded overnight into November 13. Kaspersky says the malware can give attackers control of an infected computer and steal data from crypto wallets and Telegram accounts. The firm described the link to the widget flaw as suspected and advised users to avoid opening widgets until a fix was available.