Telegram CEO says an extortionist planted CSAM in a chat to get it pulled from the App Store

Pavel Durov claims attackers post illegal content and manipulate reports to ‘trigger the removal of legitimate communities.’

Telegram CEO Pavel Durov blames an extortionist for planting child sexual abuse material (CSAM) in a public chat to get the app temporarily removed from Apple’s App Store on Monday night. “Apple removed Telegram from the App Store before contacting us,” Durov says in a post on X . “This creates a potential systemic risk for every mobile app that hosts user-generated content. If an app used by more than a billion people can be removed from the App Store without prior warning, any app can be.”

Durov adds, “Extortionists have found a way to manipulate Apple into overreacting.” Apple didn’t immediately respond to The Verge ’s request for comment.

Russia recently issued an arrest warrant for Durov, claiming Telegram facilitates terrorism, and in 2024 he was arrested in France on charges including enabling illegal transactions.

“These extortionists use automated accounts to plant illegal content in public groups and then report it directly to Apple, attempting to trigger the removal of legitimate communities whose owners refused to pay them,” writes Durov.

Durov says that the attacker in this incident “inserted AI-modified illegal content by editing an old message in an active group chat,” preventing members of the group from seeing or reporting it.

Last night Apple briefly removed Telegram from the AppStore because a user had planted illegal porn in a public chat. Telegram was restored within hours. But I want to explain what happened — to warn other app developers and help protect online communities from similar attacks. Because Telegram quickly removes illegal content from public groups using all kinds of moderation tools, the attacker had to resort to a technical trick. He inserted AI-modified illegal content by editing an old message in an active group chat. As a result the content was effectively hidden from the group’s members, preventing them from seeing/reporting it. The attacker was a takedown extortionist: someone who demands ransom from group owners in exchange for not targeting their communities. These extortionists use automated accounts to plant illegal content in public groups and then report it directly to Apple, attempting to trigger the removal of legitimate communities whose owners refused to pay them. From a practical standpoint, illegal pornographic content in Telegram’s public groups is not a systemic problem. Our moderation is effective. The fact that attackers must resort to backdated, effectively invisible content and other technical tricks proves this. ⚠️ However, there are two important lessons here for app developers and online communities: — Extortionists have found a way to manipulate Apple into overreacting. Apple removed Telegram from the App Store before contacting us. This creates a potential systemic risk for every mobile app that hosts user-generated content. If an app used by more than a billion people can be removed from the App Store without prior warning, any app can be. — The tactics used by takedown extortionists are evolving, putting communities across social platforms at risk. Telegram has extensive experience identifying the tricks used by coordinated reporting gangs and protecting legitimate communities (even when doing so risks our own app being temporarily removed from the App Store). Other platforms may not be equally prepared. Stay vigilant! ☝️