http://ainita2ucg473h7tjp3j32fu6wabxtrk2lrz6hauystamloiap3a4did.onion/iranian-gov-hackers-intercept-2fa-via-sms-to-access-activist-accounts
Very few IMs like Telegram, actually offer a second factor for authentication - in case of telegram, a password - but many do not have this function activated, as it is not required by the platform. Workarounds: Iranian users are advised to use offline methods only, i.e TOTP for their second factor authentication, and delete their phone numbers from their google records so it can not be used for password recovery or 2FA fallback.