"Someone deliberately planted illegal material to attack us," Pavel Durov said in a recent statement, describing how Telegram vanished from Apple's App Store for several hours before being restored. The messaging app was delisted after Apple's reviewers found child sexual abuse material in a public group. Within hours of Telegram removing the content and banning the user responsible, Apple put the app back online. Durov's account suggests the incident wasn't a system failure but a coordinated extortion attempt, raising uncomfortable questions about how app stores police user-generated platforms.
The attacker's method was deliberate and technically sophisticated. Rather than upload new illegal content that would trigger Telegram's AI filters and content hashes, the extortionist edited an old message already buried in chat history. This backdated modification made the change nearly invisible to other group members, preventing quick detection and reporting. Durov describes the perpetrator as a "takedown extortionist," individuals who demand payment from group owners and resort to sabotage when refused. They plant illegal material through automated accounts, then report it directly to Apple to trigger enforcement action against communities that rejected their demands. Durov said Telegram blocks 337,942 CSAM-related groups and channels in 2026 alone, but characterized this particular incident as isolated rather than systemic.
What troubles Durov most is Apple's speed. The company removed Telegram from the global App Store without contacting the company first, a decision Durov argues sets a dangerous precedent. If bad actors can plant prohibited content in any app to manipulate enforcement decisions, then every platform hosting user-generated content becomes vulnerable to the same attack vector. A single malicious user with the right technical knowledge could theoretically tank any app's availability on the world's largest mobile ecosystem. Durov didn't name the affected group, identify the attacker, or disclose any ransom demand, and his statement included no mention of police involvement or legal proceedings against the perpetrator.
