Millions of Telegram users face growing exposure to cyber threats despite an aggressive global crackdown by the platform, a new report by Check Point Software Technologies has revealed.
According to the report, Telegram removed more than 43.5 million channels and groups in 2025, with daily takedowns surging to as high as 140,000 and peaking above 500,000 in a single day.
However, cybercriminal networks continue to operate largely uninterrupted, adapting quickly to enforcement measures.
Check Point noted that Nigeria, which has one of the largest Telegram user bases in Africa with an estimated eight million users, is particularly exposed.
The platform’s popularity for cryptocurrency trading, online betting, and digital commerce makes it a key target for fraudsters and illicit operators.
What the report is saying
The report shows that enforcement actions, while significant, have not reduced the presence of cybercriminal communities.
Instead, these groups have evolved, creating backup channels in advance and rebuilding networks almost immediately after takedowns.
- “Rather than disappearing, these illicit ecosystems are reorganising, evolving, and staying one step ahead, underscoring a growing paradox: Telegram’s enforcement is record-breaking, but the threat landscape is not shrinking,” said Kingsley Oseghale, Country Manager, West Africa, Check Point Software Technologies.
According to the report, cybercriminals are also deploying more sophisticated tactics to evade detection.
These include restricting access through “request-to-join” features, using misleading disclaimers, and operating multiple parallel channels to ensure continuity.
The report notes that attackers now anticipate disruptions and build redundancy into their operations, making enforcement less effective in dismantling entire networks.
- “Telegram’s crackdown is indeed real, sustained, and growing. But so is the adaptability of cyber criminals.
- “Although takedowns are still key, discovering the cyber criminal network surrounding that channel/account is becoming more and more important,” Oseghale added.
More insights
Check Point said it noticed spikes in forwarded messages referencing blocked sources, especially during peak enforcement periods in February, March, and April 2025.
According to the company, criminal content continues to circulate even when original sources are removed, extending the lifecycle of fraud data and operational guidance.
- “This adaptation mirrors broader trends in cyber crime. Attackers no longer rely on a single asset or channel.
- “They assume disruption and engineer redundancy. Telegram’s scale, usability, and discoverability still make it uniquely attractive for this approach,” it said.
Check Point added that over the last three months alone, its Exposure Management identified approximately 3 million Telegram invite links shared across underground environments.
By comparison, Discord accounted for fewer than 6% of that volume, while Signal, SimpleX, and Matrix-based platforms barely registered.
What you should know
In December 2024, Telegram announced that it had blocked 15.4 million groups and channels as part of an intensified crackdown on harmful content, including fraud, terrorism, and child sexual abuse material (CSAM).
The development followed the arrest at that time of Telegram’s founder, Pavel Durov, in France over accusations of poor content moderation on Telegram, which allegedly made the platform a haven for terrorists and drug traffickers.
According to the company’s moderation report, Telegram now blocks tens of thousands of groups and channels daily, removing millions of pieces of content that violate its Terms of Service.
