Illicit Telegram Groups: A New Dark Web Frontier?

This article was updated July 7th, 2025.

Telegram has long been a popular communication tool for cybercriminals. Free, encrypted, and fairly anonymous, Telegram has been home to several criminal forums and marketplaces for years. Telegram is particularly prolific in hosting stealer log distribution channels which pose enormous risk to both enterprise organizations and consumer

Recently, however, that looked like it might change. The 2024 arrest of Telegram CEO Pavel Durov raised concerns among threat actors. This was particularly true after an announcement that Telegram would be cooperating more closely with law enforcement by releasing the phone numbers and IP addresses of users suspected of criminal activity. 

However, Telegram hasn’t stopped being a staple in the cybercrime ecosystem. It’s still the most popular messaging app in the criminal underground. This article explores why Telegram remains one of the most important data sources to monitor in 2026.

Why Do Cybercriminals Use Telegram?

Telegram is a messaging app with enhanced privacy and encryption features. The app works across popular mobile and desktop platforms and syncs messages across all of a user’s registered devices. Aside from private one-to-one conversations, Telegram users can subscribe to channels on which owners post content or they can become members of groups in which all participants discuss topics. 

Although cybercriminals mostly use a combination of messaging apps, Flare’s research shows that as of December 2025, Telegram is still the most-used communication tool among threat actors.

The Stealer Log Ecosystem on Telegram

Telegram is the number one platform used in the distribution of stealer logs, artifacts of infostealer malware infections that contain all of a single users credentials, session cookies, browser history, and other details of a device. In the 2020s infostealer logs have become the primary vector for account takeover attacks against both enterprise organizations and consumers. A single stealer log can expose dozens of accounts across corporate SaaS tools, banking portals, and social media, making one infection a gateway to widespread compromise.

Illicit Telegram Groups Provide Better Anonymity

Cybercriminals doubt just how much anonymity they get when using dark web forums that administrators can easily monitor. While IP addresses and geolocations get hidden automatically through a special type of routing, there is the fear of being monitored by admins and having identities revealed. Telegram advertises that it is E2E encrypted and has no traditional admins monitoring its groups and one-to-one chats, which is attractive for anonymity.

Since the arrest of Pavel Durov Telegram has started more actively cooperating with law enforcement, but compliance remains low. The sheer breadth of the cybercrime ecosystem creates challenges for law enforcement to focus and track actors across channels, and international jurisdictional challenges further complicate the picture.

Illicit Telegram Groups Perceived Anonymity

Telegram offers end-to-end encryption for messages by default, which helps to avoid potential man-in-the-middle attacks that can snoop on messages in transit. Small groups in Telegram provide perceived anonymity as they can be difficult for law enforcement and security teams to identify. Dark web forums and marketplaces also have an encryption option but threat actors need to use something like Pretty Good Privacy (PGP) to ensure encryption, which is less convenient.

Illicit Telegram Groups Offer Hardened Operations

Another important factor is how Telegram offers hacking groups and lone wolf actors a way of hardening their operations. Having to register a domain to offer services and tools for sale makes threat actors’ operations vulnerable to distributed denial of service (DDoS) attacks that can take them offline. Telegram channels bypass this requirement for a domain and ensure cybercriminals can stay online as long as the Telegram service remains online.

Common Threats on Telegram

We see many of the same threats on Illicit Telegram channels that we see on dedicated dark web markets and forums. In many cases threat actors have moved directly off of more traditional TOR websites, and onto Telegram, offering the exact same goods and services. 

In other cases we’ve seen Telegram act as a backup for major dark web forums. For example, after the recent takedowns affecting multiple instantiations of Breach Forums, new Telegram channels rapidly appeared which allowed threat actors to maintain communication.

Infected Devices and Illicit Telegram Channels

Though threat actors can buy and sell infected devices on established autoshops such as Russian Market, but they are more often found on Telegram. Telegram is the hub of the infostealer ecosystem, threat actors actively use it to distribute infostealer malware licenses, logs from infections, and even as backend infrastructure for infection campaigns.

Threat actors distribute stealer logs in various ways depending on the channel. In many cases they distribute older stealer logs for free, while monetizing access to a private channel that contains fresher logs. This creates an attractive monetization opportunity for criminals in a busy ecosystem that is easy to administer and expand operations.

Want to learn more about stealer malware? Read our report: Dissecting the Dark Web Stealer Malware Lifecycle with the MITRE ATT&CK Framework.

Illicit Telegram Channels and Stolen Credentials

There are billions of stolen credentials on the dark web. In the hands of a threat actor, these credentials can be abused to cause significant data breaches for individuals and organizations. Illicit Telegram channels are a common new vector that facilitates the routine distribution of stolen credentials. In some cases this may be for free and in other cases the credentials may be purchased through automated mechanisms on specific channels. 

Are you curious about Telegram channels and stolen credentials? Check out our Threat Spotlights on leaked credentials and on leaked credentials and geography. 

Illicit Telegram Channels and OTP Bots

Through one-time password bots (OTP bots), threat actors can try to collect 2FA codes from victims at scale. When we conducted a search in 2022 on Telegram for the terms “OTP Bot” and “2FA Bot,” we found 1,700 results. In 2025, these same terms provide over 1.1 Million results.

There is an active demand for OTP bots, as many of these results displayed activity within minutes of the query. Generally, malicious actors purchase access to bank account login credentials first, then search for OTP bot availability in fraud-oriented Telegram channels.

Threat actors typically use OTP bots for personal financial fraud rather than corporate. However, this method could be applied to corporate attacks. For example, if a data breach exposes corporate logins, a malicious actor could find those victims’ phone numbers through OSINT, then leverage that to solicit one-time passwords to bypass 2FA controls.

Want to learn more about OTP bots? Take a look at our Threat Spotlight: Illicit Telegram Markets & OTP Bots.

Will Telegram Make the Dark Web Redundant?

Despite the emergence of Telegram as a new dark web frontier, cybercriminals are likely to continue using underground dark web forums. These forums offer a range of features that Telegram does not, such as built-in scoring systems, which allow actors to establish reputations. Telegram’s previously hands-off approach and refusal to cooperate with law enforcement have also changed with the removal of several illicit channels and groups that garnered lots of subscribers. 

The dark web is unlikely to get abandoned any time soon as a cybercrime hub. Expect cybercriminals to split their operations between messaging apps and traditional underground forums and marketplaces. Comprehensive monitoring requires coverage of both the dark web and messaging apps.

Will Threat Actors Leave Telegram for Other Messaging Platforms? 

While cybercriminals are using other platforms, they’re unlikely to abandon the communities they’ve built on Telegram. There has been some migration, but so far only Signal seems to have benefited from the crackdown on Telegram. It is important to note, however, that criminals don’t stick to just one platform. Most criminals appear to be using Telegram as well as other messaging apps, and in fact they may change their messaging app depending on the data they are sharing. 

All this is to say: old habits die hard. Just as Telegram hasn’t eliminated the dark web, other messaging services aren’t likely to eliminate Telegram.

Monitoring Illicit Telegram Activity with Flare

The Flare Threat Exposure Management (TEM) solution empowers organizations to proactively detect, prioritize, and mitigate the types of exposures commonly exploited by threat actors. Our platform automatically scans the clear & dark web and illicit Telegram channels 24/7 to discover unknown events, prioritize risks, and deliver actionable intelligence you can use instantly to improve security.

Flare integrates into your security program in 30 minutes and often replaces several SaaS and open source tools. Learn more by signing up for our free trial or explore alternatives to other CTI platforms by looking at our Zerofox Competitors blog.