Our take
Maintaineda few commits in the last 90 days- Activity
- 30
- Community
- 4
- Issues
- 36
- Pull requests
- 20
+13 stars in the last 30 days
- Fewer contributors than 91% of the projects we track
Matkap brings useful Telegram C2 investigation workflows together, but its recent development is limited and concentrated in one contributor, so teams should weigh that maintenance risk against the value of its specialized features.
Good fit if
- Your work specifically involves Telegram-based malware C2 and you need token discovery, message capture or monitoring in one tool.
- You can run a Node.js web app locally and provide Telegram account credentials; PostgreSQL is optional.
- You want JADX-based investigation and are comfortable with the project's currently single-contributor maintenance profile.
Look elsewhere if
- You need a general-purpose malware-analysis engine or support for Ghidra or Binary Ninja, which the README identifies as not yet available.
- Your deployment needs built-in user authentication or access controls. The app has no login, so public exposure requires separate protection.
- Your team needs frequent releases or broad maintainer coverage; the project has had no release in over a year and most of its code comes from one person.
All health signals
| Last commit | 2026-08-25 (1 month ago) |
|---|---|
| Commits, last 90 days | 2 |
| Releases, last 12 months | 0 |
| Contributors | 1 |
| Issues closed, last 90 days | 5 (typically closed in 231 days) |
| Project age | 20 months |
Checked on 2026-10-07 with the GitHub API.
Project history
Daily GitHub snapshots since Oct 7, 2026. History covers stars and forks; health signals are not tracked historically.
Stars
1,055Forks
186Change since Nov 13, 2026: 0 stars·0 forks
Overview
Matkap helps security researchers and incident responders investigate Telegram bots used by malware to receive commands or exfiltrate stolen data. With an authorized bot token, it can validate the bot and help recover messages; it also searches intelligence feeds for exposed tokens and related indicators.
The project combines those workflows in a self-hosted web app, with optional PostgreSQL persistence and a read-only connector to the Android project open in JADX. It is a defensive investigation tool, not a malware-analysis engine, and some actions actively interact with live bots.
Key Features
- Search ThreatFox, urlscan and ZoomEye for exposed Telegram bot artifacts.
- Validate candidate tokens, resolve available chat IDs and send findings to the investigation workspace.
- Forward messages and files from an authorized bot into an investigator-controlled chat.
- Monitor a live bot's incoming updates for new exfiltration messages.
- Review TweetFeed and threat-intelligence report results, plus MalwareBazaar metadata for matching samples.
- Scan an open JADX project through a local, read-only connector, with optional AI-provider fallback.
- View statistics derived from cached malware, feed and report data.
Use Cases
- Incident responders who recover a Telegram bot token from a sample and need to examine associated operator messages.
- Threat-intelligence analysts looking for exposed Telegram C2 credentials across supported sources.
- Researchers tracking community-reported Telegram C2 indicators and related malware metadata.
- Android malware analysts who want to search an APK project already open in JADX for Telegram credentials.
What you need
Detected in the repository
- Node.js (from package.json)
- A Dockerfile, so it can run in a container; a Compose file sets up the related services
- A test suite
License in plain words
MITpermissive
- Commercial use: yes
- Modify and redistribute: yes
- You must keep: the copyright and license notice
- Share your changes: no
A summary, not legal advice: the LICENSE file is what applies.
Getting Started
git clone https://github.com/0x6rss/matkap.git
cd matkap
npm install
Configure .env with Telegram API credentials, then run npm start and open http://localhost:3000. See the README for setup details, optional database configuration and connector installation.
Considerations
- Recent activity is sparse, with only a few commits in the last 90 days and no release in over a year. Issues have been closed, but their typical resolution time has been long.
- Development is concentrated in one contributor, which may affect maintenance continuity.
- Telegram credentials and a user account are needed for the investigation workflows. PostgreSQL is optional, but without it captured logs and feed caches are not persistent.
- Monitoring and resolving bots can alter live bot state, including deleting webhooks. Use only within an authorized investigation.
- The app has no built-in login or rate limits. Do not expose an instance publicly without adding access controls.
- The JADX connector is the only supported reverse-engineering connector currently; AI-provider keys are optional for its local preflight workflow.
Found this useful?
Share it with someone who would like matkap.