How Extortionists Took Telegram Off the App Store, And How Scammers Made Six Figures Off My Startup

Last night Apple briefly removed Telegram from the App Store. Not for a systemic moderation failure, but because one user planted illegal pornographic content in a single public group. Telegram was back within hours.

The outage is not the interesting part. The method is.

What Actually Happened

Telegram removes illegal content from public groups fast, so posting it and waiting was never going to work. Instead the content was inserted by editing an old message in an active group chat. Backdated content sits far up in the scroll history where no member will ever look again, so the group never saw it, so nobody reported it.

Then the attacker reported it. Not to Telegram. To Apple.

This is an established business with a name: takedown extortion. You demand a ransom from the owner of a public group in exchange for not targeting their community. If they refuse, you plant illegal content.

The Attack Moved Down a Layer

Telegram’s moderation works well enough that flooding the platform is no longer viable. This incident proves it: if you have to resort to AI-modified material, and backdated edits to invisible messages, the direct route is closed.

So the attackers don’t go after the platform. They go after the groups. And not the groups’ technology either, they go after the people running them. And for enforcement of their extortion tactic they do not touch Telegram’s systems at all. They use Apple’s.

That is the nasty part. App Store review has enormous leverage, very little context, and a strong incentive to act first and ask later, so it got turned into a weapon. An app used by a billion people was removed before anyone contacted the company that makes it. If it can happen to Telegram it can happen to anything hosting user generated content (UGC). Another important takeaway is that coordinated reporting gangs are evolving faster than most platforms are prepared for, and Telegram has years of experience spotting them where a smaller competitor has none.

This Is Catch Me If You Can

If you have not seen the movie: Frank Abagnale is a teenager in the sixties forging checks, posing as a Pan Am pilot, then a doctor, then a lawyer, cashing millions on the way. FBI agent Carl Hanratty spends years chasing, and every time Hanratty works out the current method and closes it, Abagnale is on the next one. Not one clever trick, a sequence of them, each a response to the last countermeasure. Cat and mouse.

How Scammers Made Six Figures Off My Startup

I founded SocialHubs, where we ran five social networks that accumulated over 1.5 million users. The hackers were the easy part: one early intrusion, no data compromised, one all-nighter to close it, never a breach again. The scammers were the war, and it ran nonstop.

It started with our feed, which showed every post in the order it was made. With a small user base that was great. Scammers loved it for exactly the reason our users did, because it handed every mass posted crypto link guaranteed reach for free. Then it went round by round.

Time zones. My first hire was a content moderator, based in Germany, like me. It took the scammers just a few days to notice that nothing got deleted between midnight and eight, so they went all in at night: several people at once, multiple accounts, often more than 5,000 posts per account, by hand. We woke up to twenty thousand spam posts, built bulk deletion and account purging, and I stayed up until 3 or 4 to purge them myself. We had moderators from other time zones join us too. None of it fixed the problem, and neither did banning IPs, ranges, fingerprints or behavioral patterns. Against professionals with unlimited addresses to burn, IP banning is theater.

The algorithm. A smarter feed sat on the backlog as a nice-to-have. I called Alarmstufe Rot, red alert, and made it a P0: score posts by the interaction they get instead of by timestamp. Crypto spam gets no interaction, so it reaches almost nobody before deletion. Two developers, two days. It worked, for a while, and then they started boosting each other, which cost nothing since they already had piles of accounts.

Account age. So: new accounts get a reach penalty until they have been around a bit. Two weeks later they had reverse engineered the exact number of days, so they mass created accounts, saved the credentials, let them sit idle exactly long enough, then woke them up. Their posts got better too, telling a story about why this coin mattered to users of that specific app - which is conversion rate optimization.

Deepfakes. Once we supported video they worked out that video converts far better, and posted clips of very famous people on what looked like a CNN or Fox News set talking about their coin. Realistic video, realistic voice, good script, account named after that person with a blue checkmark. It was so good that the first time I saw one, even my first reaction “oh celebrity xyz actually has a coin”… well…

The Number That Told Me Everything

Let’s do some maths. Our biggest revenue stream was premium-purchases, which users could buy, giving them a blue checkmark and removing ads from their feed.

Here is the interesting part: the scammers bought premium. On accounts they knew would be purged in the morning.

Premium was 35 EUR, one time, for lifetime access. In their case lifetime meant five or six hours, because then our moderators would purge the account. They paid anyway, because premium meant a blue checkmark, the checkmark meant credibility, and credibility meant conversion. Not once as a test. On multiple accounts, every night, for months.

That purchase is a measurement. It is the attacker telling you, with their own money and no reason to lie, what a few hours of borrowed trust on your platform is worth. Every abuse metric I ever built was noisier than that one number.

It also sizes their business. Three premium buys a night is 3,000 EUR a month on our platform alone, and three or four people plus proxies, VPNs and phone numbers puts them north of 6,000 before profit. Call it 10,000 a month, or roughly 120,000 EUR a year. Treat that as an order of magnitude, not a figure: the wage assumption is shaky, and the fact that they were certainly not hitting only us pushes it back up. Either way, this is a small, profitable, six figure business. A company.

And all of it happened before November 2022 (ChatGPT release). No LLMs writing posts, no agents running accounts. Just a team that was organized, patient and economically rational, doing IP rotation, fingerprint evasion, credential warehousing, timed account aging, engagement rings, and deepfakes good enough to briefly fool even the person who built the platform. Adjust upward for everything shipped since.

What To Take From It

You are not going to win, you are going to raise their costs. Every countermeasure bought weeks, sometimes days. That is not failure, that is the job. The question is never “is this fixed,” it is “did their cost per successful scam go up and ours go down.”

Follow the money, because they do. Night hours, premium, aged accounts: every move was the better ROI. To predict the next one, ask what is cheap for them and expensive for you. Telegram’s extortionists moved from the platform to the group admins for exactly that reason.

Watch the seams, not the walls. Each of our defenses worked. The gaps were where everything happened: the hours nobody was awake, the window before an account was old enough, the space between a post existing and someone reporting it. Telegram’s attacker found exactly that kind of gap, then reached for a lever outside the system entirely.

Wrapping Up

If four people could run a six figure business against 1.5 million users, platforms a thousand times bigger are playing the same game against far better funded opponents.

Which is what we just watched. Attacking Telegram directly stopped paying, so the attack moved to the group owners, with Apple as the hammer. That is not the defense failing. That is the defense working and the attack relocating.

It always relocates. Hanratty never stopped Abagnale with any single trick. In the end Abagnale went to work for the FBI, on the exact problem Abagnale used to be. You do not close the loop, you just get better at running it.