Telegram Desktop: one-click account takeover via IPC injection