Telegram warns of ‘takedown extortion’ after temporary App Store removal

Telegram says cybercriminals are exploiting platform moderation systems by planting illegal content and filing complaints to force app takedowns, highlighting a growing threat to online communities and platforms hosting user-generated content.

Telegram has disclosed details of what it describes as a new cyber-enabled threat called "takedown extortion", following the temporary removal of its app from Apple's App Store. The messaging platform said the incident demonstrates how cybercriminals are increasingly attempting to manipulate content moderation systems to disrupt legitimate online communities.

According to the company, the app was reinstated within hours after the reported illegal content was removed and the account responsible for posting it was permanently banned. Telegram said the episode underscores the importance of strengthening awareness around emerging tactics that misuse platform enforcement mechanisms.

Attackers exploiting moderation systems

Telegram alleged that cybercriminals are using automated accounts to upload illegal content into public groups before immediately reporting it to platform operators. The objective, the company said, is to trigger enforcement actions against group administrators who refuse to comply with extortion demands.

The company further explained that, in the latest incident, the attacker allegedly exploited Telegram's message-editing feature by modifying an older message to include illegal material. Because the edited content appeared in a previously published message, it was effectively hidden from regular group activity, making it difficult for community members to detect and report it promptly.

Commenting on the incident, Pavel Durov, Founder and CEO, Telegram, said: “The tactics used by takedown extortionists are evolving, putting communities across social platforms at risk. If an app used by more than a billion people can be removed from the App Store without prior warning, any app can be.”

Durov further added: "The fact that attackers must resort to backdated, effectively invisible content and other technical tricks proves that our moderation is effective."

Telegram calls for broader vigilance

Telegram said it continues to strengthen its moderation capabilities through advanced detection technologies and community protection measures designed to identify and remove illegal content from public groups as quickly as possible.

The company also urged the broader technology industry to remain alert to increasingly sophisticated forms of coordinated abuse targeting platforms that host user-generated content. It warned that as extortion techniques evolve, similar attacks could affect a wide range of digital platforms, making collaboration between technology providers and stronger content moderation practices increasingly important to protect online communities.