Telegram claims to have suffered from "de-listing extortion" attacks: the temporary removal of the app from the Apple App Store was caused by a user embedding prohibited content

Telegram founder and CEO Pavel Durov stated that Telegram was briefly removed from the App Store by Apple recently due to a user embedding illegal pornographic content in a public group. The app was restored within hours.

Durov mentioned that the attackers exploited a technical vulnerability to insert AI-modified illegal content into old messages in active groups, hiding the content by editing historical messages, making it difficult for regular group members to discover and report it in a timely manner. Such attacks are classified as "takedown extortion," where attackers use automated accounts to embed violations in public groups and report them to platforms like Apple, attempting to force group administrators to pay a ransom, or else the community would be banned due to platform rules.

Durov further explained that Telegram continuously combats illegal content through user reports, AI filtering, content hashing, and other mechanisms. This incident is not a systemic issue of the platform but rather a targeted attack exploiting rule loopholes by the attackers.

He also warned that Apple's direct removal of the app without prior contact with Telegram could pose risks to all mobile applications that provide user-generated content (UGC), and platform developers need to enhance their defenses against malicious reporting and "takedown attacks."