Telegram CEO Warns AI-Powered Takedown Extortion Threatens Instagram, YouTube and All Apps

Telegram Briefly Removed From Apple App Store After AI-Powered Attack

Telegram was temporarily delisted from the Apple App Store earlier this week following what founder Pavel Durov calls a "takedown extortion" attack. The incident involved a malicious actor who edited an old message in an active group chat to display AI-modified illegal content that group members would not notice or report1

1

2

2

. Apple removed Telegram from the App Store before contacting the company, though the app was restored within hours3

3

.

How Takedown Extortion Works

Telegram CEO Pavel Durov explained the attack method in detail. The extortionist inserted AI-modified illegal pornographic content by editing an old message inside an existing group chat rather than posting new content3

3

. Because the content was placed inside an existing message, it remained hidden from group members, preventing them from seeing or reporting it. Telegram's moderation systems, built to detect and remove illegal content from public groups, did not flag it for the same reason3

3

. The attacker then deployed automated accounts to report the planted content directly to Apple, setting up an extortion attempt where the actor threatened to continue unless Telegram paid1

1

2

2

.

Systemic Risk for Platforms Hosting User-Generated Content

Durov warned that this incident exposes a systemic risk for platforms with user-generated content. "Extortionists have found a way to manipulate Apple into overreacting. Apple removed Telegram from the App Store before contacting us. This creates a potential systemic risk for every mobile app that hosts user-generated content," he stated1

1

2

2

. He emphasized that if an app used by more than a billion people can be removed from the App Store without prior warning, any app can be3

3

. This vulnerability extends to major social platforms including Instagram, YouTube, and X3

3

.

AI Tools Enable Sophisticated Coordinated Abuse

The proliferation of AI tools has made this type of AI-powered cyber threat easier to execute. Between video and image editing tools in chatbots and the speed of task execution agents are capable of, attackers can now modify content in ways that bypass traditional moderation systems1

1

. Pavel Durov noted that the fact attackers had to resort to backdating content inside old messages and making it invisible to group members was evidence that standard methods of planting illegal content no longer work on Telegram3

3

. The method represents a technical escalation from earlier forms of coordinated abuse that relied on mass false reporting alone3

3

.

Platform Accountability and Gatekeeper Response

The incident reignites questions about platform accountability and how gatekeepers like Apple should respond to abuse reports. Apple acted on the report filed directly by the attacker and removed the app delisted by Apple from the App Store before making any contact with Telegram's team3

3

. This sequence exposed a significant gap in how platform gatekeepers respond to abuse reports involving user-generated content. Responsibility for user-generated content is not a new issue, and questions about culpability for users' possible illegal activity have been debated for years1

1

. Telegram and Durov have faced similar scrutiny before over possible illegal activity on the platform2

2

.

What App Developers Should Watch For

Durov made his account of the incident public to alert other developers and online communities to what he described as an evolving threat3

3

. He said takedown extortion tactics are evolving and that any platform hosting user-generated content is now a potential target3

3

. Durov added that Telegram has extensive experience identifying tricks used by coordinated reporting gangs and protecting legitimate communities, even when doing so risks the app being temporarily removed from the App Store, and warned that other platforms may not be equally prepared3

3

. Developers should prepare for similar attacks by strengthening their ability to detect edited historical messages and establishing direct communication channels with app store operators to prevent removal without warning.