Upgrade to 7.2.9 or later. That is the only thing that actually closes the problem. The rest reduces exposure. • Turn on “ask where to save each file”. With that setting, automatic download does not happen at all, and the instruction file never reaches the disk. It is the most effective mitigation short of upgrading. • Limit who can add you to groups to your contacts only. Stolen files can only be sent to a channel or a supergroup, so this takes away the place the attacker would have them delivered to. • Set a local passcode, and choose it like a real password. It does not prevent the files from being stolen; it only makes the stolen session unusable. • Disable automatic download: Open Telegram Desktop and click the three horizontal lines (menu icon) in the top-left corner. Click on Settings. Select Advanced. Scroll down to the Automatic Media Download section. Choose the chat types to manage (Private Chats, Groups, and Channels) and toggle off photos, videos, and files as desired.