Apple briefly removed Telegram from its App Store late on Monday after detecting child sexual abuse material (CSAM) in a public group. The messaging app was restored within about 40 minutes once Telegram deleted the content and banned the responsible user. Telegram CEO Pavel Durov later described the incident as the work of a “takedown extortionist” who deliberately planted AI-modified illegal content to trigger the removal and pressure online communities.
According to Durov’s statement on X (see below), the attacker edited an old message in an active public group chat to insert the prohibited material. Because the edit was backdated, the content remained effectively invisible to ordinary group members, limiting their ability to report it through normal channels and helping it evade some of Telegram’s automated moderation tools. The perpetrator then reportedly flagged the material directly to Apple.
Durov characterized the actor as a takedown extortionist—someone who demands payment from group owners in exchange for not targeting their communities. These operators, he said, rely on automated accounts to seed illegal material in public groups and then report it to platform gatekeepers such as Apple in an effort to force the removal of legitimate communities whose administrators refuse to pay.
“From a practical standpoint, illegal pornographic content in Telegram’s public groups is not a systemic problem,” Durov wrote. “Our moderation is effective. The fact that attackers must resort to backdated, effectively invisible content and other technical tricks proves this.” He emphasized that Telegram routinely removes illegal material from public groups using a range of moderation tools.
Apple confirmed that a content review had identified CSAM that violated App Store guidelines. The company stated that Telegram “promptly removed the content and banned the user,” after which the app was returned to the store. Apple has not publicly addressed Durov’s claim that an extortionist manipulated the process. Durov noted that Apple pulled Telegram before contacting the company.
Durov framed the episode as a warning for other developers. “Extortionists have found a way to manipulate Apple into overreacting,” he said. “This creates a potential systemic risk for every mobile app that hosts user-generated content. If an app used by more than a billion people can be removed from the App Store without prior warning, any app can be.” He also cautioned that the tactics used by such coordinated reporting groups are evolving and that other platforms may be less prepared to identify and counter them.
The incident underscores ongoing tensions between large platforms that host user-generated content, the moderation challenges they face, and the policies of mobile app marketplaces that can unilaterally restrict distribution. Telegram continues to operate normally on iOS following the short-lived removal.
Last night Apple briefly removed Telegram from the AppStore because a user had planted illegal porn in a public chat.
Telegram was restored within hours. But I want to explain what happened — to warn other app developers and help protect online communities from similar attacks.
Because Telegram quickly removes illegal content from public groups using all kinds of moderation tools, the attacker had to resort to a technical trick. He inserted AI-modified illegal content by editing an old message in an active group chat. As a result the content was effectively hidden from the group’s members, preventing them from seeing/reporting it.
The attacker was a takedown extortionist: someone who demands ransom from group owners in exchange for not targeting their communities. These extortionists use automated accounts to plant illegal content in public groups and then report it directly to Apple, attempting to trigger the removal of legitimate communities whose owners refused to pay them.
From a practical standpoint, illegal pornographic content in Telegram’s public groups is not a systemic problem. Our moderation is effective. The fact that attackers must resort to backdated, effectively invisible content and other technical tricks proves this.
⚠️ However, there are two important lessons here for app developers and online communities:
— Extortionists have found a way to manipulate Apple into overreacting. Apple removed Telegram from the App Store before contacting us. This creates a potential systemic risk for every mobile app that hosts user-generated content. If an app used by more than a billion people can be removed from the App Store without prior warning, any app can be.
— The tactics used by takedown extortionists are evolving, putting communities across social platforms at risk. Telegram has extensive experience identifying the tricks used by coordinated reporting gangs and protecting legitimate communities (even when doing so risks our own app being temporarily removed from the App Store). Other platforms may not be equally prepared.
Stay vigilant! ☝️
MacDailyNews Take: Apple’s App Store really is one of history’s most profitable cans of worms.
It’s an astonishing money machine: the broader App Store ecosystem facilitated over $1.4 trillion in developer billings and sales in 2025 alone. Physical goods and services (retail, food delivery, travel, etc.) made up the bulk (~$1.1 trillion), where Apple takes no commission. Digital goods and services accounted for about $149 billion, and in-app advertising another $151 billion. On the digital slice Apple typically charges 15–30%, generating many billions in high-margin revenue that helps power its Services business.
Yet the same walld garden that produces those results is a perpetual source of headaches. Apple’s near-total control over iOS distribution and payments has fueled years of antitrust battles — Epic Games, the U.S. DOJ, EU Digital Markets Act enforcement, court findings of non-compliance, and ongoing developer lawsuits. Critics call the commission the “Apple Tax,” complain about arbitrary review decisions, limited sideloading or alternative stores (outside certain regulated markets), and the risk that a single content flag can yank a major app offline without warning.
The recent Telegram episode fits the pattern perfectly. A brief App Store removal triggered by planted illegal content (which Telegram says was the work of a takedown extortionist) showed how Apple’s gatekeeper power can be gamed or lead to rapid, high-stakes reactions.
Please help support MacDailyNews — and enjoy subscriber-only articles, comments, chat, and more — by subscribing to our Substack: macdailynews.substack.com. Thank you!
Support MacDailyNews at no extra cost to you by using this link to shop at Amazon.
Apple should not be allowed to restrict what applications users instal on their mobile devices. Users should be allowed to install applications outside of the App Store.