https://finance.yahoo.com/news/telegram-app-targeted-crypto-mining-153013554.html

The malware exploited a feature that allows its messaging software to recognize Arabic and Hebrew language text, which is read right to left.

By using a hidden character in the feature that reversed the order of the characters, the attackers could rename a file, triggering the installation of the malware. Examples of the malicious software were only found in Russia, Kaspersky said.