Telegram allows logins per SMS code (they will be rolling out changes in two days). So as long as you knew the number of your victim and have the ability to re-route SMS, you were able to login to other people’s accounts.
Of course this can be easily mitigated by setting a “cloud password”, but I guess most people don’t do that.
Of course this can be easily mitigated by setting a “cloud password”, but I guess most people don’t do that.