Business Briefings
Telegram users face rising cyber threats despite 43.5m takedowns — Report
Millions of users of Telegram remain exposed to escalating cyber threats despite a sweeping global crackdown by the platform, according to a new report by Check Point Software Technologies.
The report revealed that Telegram removed more than 43.5 million channels and groups in 2025, with daily takedowns reaching as high as 140,000 and exceeding 500,000 on peak days. Despite these efforts, cybercriminal networks continue to operate with minimal disruption, rapidly adapting to enforcement actions.
Read Also:
- ECB Slaps JPMorgan With Record Fine Over Misreported Capital Data
- New Tax Law Targets Double Taxation, Expands Compliance Framework
Nigeria, identified as one of Africa’s largest Telegram markets with an estimated eight million users, was highlighted as particularly vulnerable. The platform’s widespread use for cryptocurrency trading, online betting, and digital commerce has made it a prime target for fraudsters and illicit operators.
According to the report, enforcement actions have not significantly reduced the presence of cybercriminal communities, as operators now create backup channels and rebuild networks almost immediately after takedowns.
“Rather than disappearing, these illicit ecosystems are reorganising, evolving, and staying one step ahead, underscoring a growing paradox: Telegram’s enforcement is record-breaking, but the threat landscape is not shrinking,” said Kingsley Oseghale, Country Manager, West Africa at Check Point Software Technologies.
The report noted that cybercriminals are increasingly deploying sophisticated evasion tactics, including restricted “request-to-join” access, misleading disclaimers, and multiple parallel channels to sustain operations.
“Telegram’s crackdown is indeed real, sustained, and growing. But so is the adaptability of cyber criminals. Although takedowns are still key, discovering the cyber criminal network surrounding that channel or account is becoming more and more important,” Oseghale added.
Further findings showed spikes in forwarded messages referencing blocked sources during peak enforcement periods, particularly between February and April 2025. This has enabled criminal content to persist even after original sources are removed.
Check Point disclosed that, within the last three months, its exposure management systems identified approximately three million Telegram invite links circulating across underground networks. In comparison, competing platforms recorded significantly lower activity levels.
Read Also:
