sigh https://cybernews.com/security/one-click-telegram-desktop-exploit-hijacks-accounts/

basically you could have send files to a group which are cached, then sent a malicious tg:// link, just clicking on it exfiltrates your session and results into an hijacked telegram account.