Telegram was subject to a "takedown extortionist" who planted AI-modified child sexual abuse material (CSAM) to get Apple to remove the app from the App Store, Telegram CEO Pavel Durov said today. Apple removed Telegram from the App Store for about 40 minutes on Monday night after discovering CSAM, but reinstated the app after Telegram removed the content.
The attacker was a takedown extortionist: someone who demands ransom from group owners in exchange for not targeting their communities. These extortionists use automated accounts to plant illegal content in public groups and then report it directly to Apple, attempting to trigger the removal of legitimate communities whose owners refused to pay them.
Durov said the attacker used a "technical trick" to evade moderation tools, editing an old message in an active group chat to add illegal content. The attacker was able to bypass moderation because group members didn't see the message to report it. Durov said illegal pornographic content in public groups is not a systemic problem because Telegram has effective moderation, and this was an edge case where an attacker used "backdated, effectively invisible content."
Apple pulled Telegram from the App Store before contacting the company, according to Durov. He said Apple was manipulated into overreacting, and he warned of a "potential systemic risk for every mobile app that hosts user-generated content."
After removing Telegram from the App Store, Apple said a content review found child sexual abuse material that violated the App Store guidelines. Apple further said Telegram "promptly removed the content and banned the user," leading to the app's return to the App Store. Apple has not commented on Durov's extortionist claim.
