thumbnail Telegram zero-day allowed sending malicious Android APKs as videos