- Telegram reaches a record level of moderation with peaks of up to 500.000 daily closures of channels and groups.
- Despite the effort, around 20% of the blocked channels are still linked to carding, data selling, and hacking services.
- The platform continues to be the main focus of criminal activity, with nearly 3 million invitation links in clandestine environments.
- Experts urge companies and SOCs to treat Telegram as a critical threat environment and not rely solely on internal moderation.
Telegram has become one of the most tense battlegrounds on the internet today: on the one hand, it boasts a record of moderation and channel closures , and on the other, it remains a favorite platform for cybercriminals . This paradox is particularly striking in Spain and Europe, where the app is under intense regulatory pressure and constant scrutiny from authorities and cybersecurity experts.
In recent months, the messaging platform has gone from being seen as a relatively permissive environment to a battleground between regulators, the company, and criminal networks . Despite an unprecedented moderation offensive, cybercriminals are not only not abandoning Telegram, but are adapting at a pace that seriously complicates their eradication.
An unprecedented record of moderation on Telegram
Recent analyses from specialized firms, such as Check Point Software, indicate that Telegram has reached record levels of channel and group deletion . During 2025, the platform closed more than 43,5 million spaces, a figure that reflects a radical shift compared to previous years.
This effort has intensified even further: in 2026, Telegram recorded days with over 500.000 channel closures , a staggering leap compared to the approximately 10.000 closures per day that were typical in the past. The company has deployed automation systems and compliance mechanisms that, on paper, increase the pressure on illegal groups.
This shift comes at a particularly delicate time. Following the arrest of Pavel Durov, CEO and founder of Telegram, in late 2024, the company has been compelled to increase transparency and strengthen moderation . This is compounded by growing friction with European authorities, and in particular with the Spanish government, which has been highly critical of the platform's role in the dissemination of illicit content and disinformation.
Durov himself addressed users directly at the beginning of the year to warn that certain regulatory initiatives on social networks could lead, in his view, to a kind of permanent “surveillance state .” This political and legal clash contrasts sharply with the technical reality: Telegram, whether one likes it or not, is closing channels at an unprecedented rate.
Spain and Europe: regulatory focus and rise in fraud
In the Spanish and European context, Telegram is a cause for concern not only because of the content circulating on it, but also because of its role in the rise of scams and financial crimes . In Spain, various analyses have placed the application at the forefront of channels used for digital fraud, accounting for a significant share of the incidents detected in the country.
Recent reports have indicated that in 2025, Telegram accounted for approximately 22% of certain categories of scams reported in Spain, placing it ahead of other common platforms. The combination of encryption, relative anonymity, and ease of creating large groups and channels makes it a comfortable environment for criminals to operate.
European authorities and cybersecurity teams are watching with concern as the app, despite intense moderation efforts, continues to be considered a critical security asset . Ignoring what is happening on Telegram, experts insist, is tantamount to leaving a significant part of the threat landscape in the dark.
This scenario has led to a complex standoff: while governments and regulators demand more control and capacity to act, the company is trying to demonstrate that it is strengthening its internal policies and processes , without giving up the image of a haven for privacy that has made it so popular among millions of European users.
The paradox: more closures, same criminal activity
The major problem revealed by recent studies is that record moderation rates do not translate into a clear reduction in illicit activity. According to Check Point, nearly 20% of the channels blocked on Telegram were related to crimes that directly affect businesses and users, such as carding (credit card fraud), the sale of personal data, and the offering of hacking services.
Far from disappearing, these communities reorganize themselves in a matter of hours. Criminal networks now operate with the understanding that shutdowns are a part of everyday life and have incorporated this pressure as another factor in their business model. The result is a kind of large-scale cat-and-mouse game , in which the attackers' ability to adapt competes with the automation of moderation systems.
Experts point out that the criminal ecosystem within Telegram has assumed that some channels will always go down, so it operates with redundancy, distributed structures, and alternative channels ready to be activated. Increased moderation has indeed generated friction, but it hasn't significantly dismantled the criminal infrastructures that use the platform.
The cybersecurity firm itself warns that this situation creates “critical blind spots” if companies and security teams don't incorporate Telegram into their standard threat analysis and detection processes. Ignoring what's happening in the app opens a window of opportunity that attackers are exploiting with relative ease.
Telegram, the nerve center of cybercriminals
If the moderation offensive were truly effective in removing criminals, one would expect a mass migration to other platforms . However, the data does not reflect this movement. Telegram remains the epicenter of much of the organized criminal activity on the messaging channel.
The latest quarter analyzed by Check Point highlights this concentration: nearly 3 million invitation links to Telegram groups and channels were counted, shared on forums and underground spaces. In contrast, Discord accounts for less than 6% of these links, and alternatives like Signal, SimpleX, and Matrix have a negligible presence in these environments.
Telegram's dominance as the "main square" for cybercrime can be explained by several factors: its enormous user base, the ease of sharing access links, its support for large communities, and the perception that it is a platform difficult to fully control . All of this means that, despite occasional attacks, cybercriminals prefer to adapt their methods rather than move to other services.
For experts, this reality compels corporate security teams and security operations centers (SOCs) to treat Telegram as a priority monitoring environment . It's not just another app, but one of the places where many targeted attacks against users and companies in Europe are planned or facilitated.
How criminal networks are adapting to record restraint
The increase in closures and controls has led criminal networks to refine their tactics. Far from operating openly, many groups have shifted to more secretive and sophisticated models that seek to circumvent the automated detection systems deployed by the platform itself.
One of the most common techniques is the use of the "Request to Join" function, which requires approval to enter certain channels or groups. With this filter, administrators attempt to block moderation bots or suspicious profiles from entering , reducing the visibility of their activities to automated systems.
Another widespread tactic is the inclusion of notices in channel bios, mentioning Telegram's management or referencing internal policies, as if these were spaces that strictly adhere to the rules. These messages act as a cosmetic layer to simulate compliance , even though the actual content may still be linked to illicit activities.
In addition, many groups have backup channels with pre-loaded audiences, ready to be activated as soon as a primary channel is shut down. This redundancy strategy allows the community to reorganize very quickly after a mass closure, maintaining almost its operational capacity intact and preventing the loss of key followers.
In parallel, distributed network structures are being consolidated, with multiple interconnected channels that share functions (communication, sales, support, tool distribution, etc.). This design means that dismantling one channel has a limited impact on the overall criminal infrastructure , seriously complicating dismantling efforts.
Implications for companies and cybersecurity teams
For European organizations, the scenario painted by these reports goes beyond a matter of social media moderation. The constant presence of groups dedicated to trading personal data, carding, and hacking services makes Telegram a direct risk to corporate security.
Experts insist that relying solely on the platform's own compliance policies is insufficient. Although Telegram is breaking records for account closures and boasts greater transparency, the figures show that a significant portion of criminal activity continues , adapting to the new reality.
Therefore, companies and public administrations are advised to invest in specific capabilities for channel monitoring, invitation link analysis, and threat monitoring that originates or is coordinated through the application. Continuous exposure management and threat intelligence become key to detecting suspicious activity before it results in attacks.
The analysts' message is clear: ignoring Telegram as a high-risk environment can lead to security breaches that are difficult to detect in time. Treating the platform as just another component of the digital perimeter—like email, the web, or corporate networks—has become, at this point, a necessity rather than a recommendation.
All of this highlights an uncomfortable reality: despite record moderation and stricter controls , Telegram remains a key meeting point for cybercriminals. The combination of increasing regulatory pressure, an ever more aggressive technical response, and highly adaptable digital crime paints a complex picture, in which neither platforms nor authorities can let their guard down if they truly want to reduce the influence of organized crime in the messaging ecosystem.
