Known as the best alternative to WhatsApp, Telegram has gained a lot of publicity over the past 2 years. However, the company has faced intense criticism for not doing enough to curb fake vaccination cards or revenge porn on its platform. And now a new study has found that Telegram is an attractive magnet for cybercriminals.
See also: Telegram has not removed the AI Bot used for revenge porn
The revelation comes from a study conducted by Cyberint. The cybersecurity firm found that hackers are selling and sharing data leaks on Telegram because it is easy to use and does not impose many mitigations.
In the past, such data trades were largely confined to the so-called “dark web,” a part of the internet that can only be accessed with special browsers and connections. Hackers find the dark web attractive because it is located in a corner of the deep web — meaning, the part of the internet that doesn’t show up in search engines — that is even more protected from outside observers and interference.
All of these barriers come with a price: Not just anyone can access the dark web. And that’s where Telegram comes in. It’s easy to download the app and create an account. The service’s “secret” chats use edge-to-edge encryption for added privacy. And while group chats don’t have the same protection, you need a link or an invitation to join. Telegram also allows for mass group chats of up to 200,000 users.
See also: Telegram: How to move or backup secret chats on Android?
These features have led to what Cyberint threat analyst Tal Samra called over a “100 percent increase” in Telegram’s use by cybercriminals. “The encrypted messaging service is becoming increasingly popular among threat actors conducting fraudulent activities and selling stolen data … as it is more convenient to use than the dark web.”
The increase in Telegram usage was caused, according to the study, by recent privacy changes to Facebook-owned WhatsApp.
Cyberint found that reports of certain terms hackers use when exchanging stolen emails and passwords “quadrupled” between 2020 and 2021. The research also cites a public channel called “combolist”—the name itself a reference to hacker terminology—where entries were sold or simply shared.
There were about 47,000 users on the channel when Telegram shut it down. The Cyberint study also found that there is a market on Telegram for financial data, personal documents, malware and hacking guides, in addition to online account credentials.
See also: How to delete old profile pictures on Telegram
The dark web itself is fueling Telegram's growth, Cyberint found. The company's researchers observed a huge increase in links to Telegram destinations shared on dark web forums between 2020 and 2021, from about 172,000 last year to more than a million this year.
Telegram has not yet commented on the incident.
