How We Investigated AI-Generated Child Sexual Abuse Material on Social Media and Apps

It all started with an incident that happened in Johor, Malaysia, in 2025. A 16-year-old downloaded photographs of schoolmates from social media, uploaded them to an AI tool to create sexualized deepfake images, and traded the images through messaging apps. The case only came to light after the teenager sent some of the images to the victims, seemingly to provoke or intimidate them. More than 40 students were affected, the youngest just 13.

What stayed with us was not only the harm caused to those children, but also what the incident revealed: A teenager had been able to reproduce some of the same practices found in wider child sexual abuse material (CSAM) networks. This raised a bigger question for us: Was this really just a school incident, or a glimpse of a much wider problem? To understand the risks children face online, we first needed to understand the digital spaces they use every day, and the criminal networks that can grow around them.

Read the original investigation.

---

As a nonprofit journalism organization, we depend on your support to fund more than 170 reporting projects every year on critical global and local issues. Donate any amount today to become a Pulitzer Center Champion and receive exclusive benefits!

---

Why this story?

The 16-year-old was arrested, expelled, and later pleaded guilty to all three charges. The court placed him on a two-year good behaviour bond. It opened a wider conversation about sexual harassment, eventually contributing to a #MeToo movement among students at private schools.

That conversation matters. But for us, another part of the story could easily be overlooked: Generative AI has made it possible to turn ordinary photographs into sexualized images with relatively little technical skill. For children, this means a photograph shared online can potentially be taken out of context, manipulated and used to humiliate, threaten, or sexually exploit them.

In 2025, Malaysia saw its largest child sexual abuse material (CSAM) operation to date, according to police. One troubling finding was that some suspects involved in the production, distribution and sale of CSAM were children.

This challenged the way we often think about online child sexual exploitation. We tend to picture adults as perpetrators and children only as victims. The reality can be more complicated. Children can be harmed, exploited and, in some cases, drawn into harmful activities involving other children.

For us, this is at the heart of the investigation: When technology lowers the barriers to harming and exploiting others, children can also be drawn into criminal networks before they fully understand where those actions may lead.

Things to do before starting the investigation

Before starting the investigation, we took several steps to protect both the newsroom and the journalists involved. This was important because investigating CSAM carries not only legal and digital security risks, but also emotional risks for journalists who may be exposed to disturbing material over an extended period of time.

Seek legal advice before accessing or handling CSAM

In some countries, possessing or handling CSAM can itself be a criminal offense, including when the material is accessed for research or investigative purposes. In Malaysia, the law does not currently provide a clear written defense specifically for journalists who handle CSAM in the course of their work.

We, therefore, sought legal advice before beginning the investigation. We wanted to understand what we could lawfully access, collect, store, and report, and what precautions we needed to take when dealing with potentially illegal material.

Our legal counsel, Kee Hui Yee, of Kanesalingam & Co., advised that there is no explicit public interest or journalistic defense under Malaysia’s Sexual Offences Against Children Act 2017 (SOACA), Penal Code or Communications and Multimedia Act 1998 (CMA).

For comparison, the legal opinion noted that:

In Singapore, Section 377BN of the Penal Code specifically spelled out Defences to Child Abuse Material Offences. Subsection (2) stipulated that it is a defence if the act was done solely for the prevention, detection or investigation of an offence, conduct of court proceedings, and if the material was not kept longer than reasonably necessary.

In the United Kingdom, the Protection of Children Act 1978 and Criminal Justice Act 1988 provide a defence for those who have a “legitimate reason” for distributing, showing, or possessing indecent photographs of children. This defense is available for a genuine researcher who has “no alternative but to have such unpleasant material in his possession.” In Atkins v Director of Public Prosecutions; Goodland v Director of Public Prosecutions [2000] 2 All ER 425, the court held that such legitimacy is a question of fact, determined by purpose and manner of possession.

This legal advice shaped how we approached the investigation. Rather than assuming that journalistic or public-interest work would protect us, we treated the handling of CSAM as a serious legal risk from the outset.

Put digital security measures in place

We requested cybersecurity training from the Pulitzer Center to implement a digital security plan to protect our devices, accounts, communications, and any sensitive evidence.

Prepare for the emotional impact

Investigating child sexual exploitation meant repeatedly encountering disturbing accounts, interviews, and material. We knew that prolonged exposure could affect journalists emotionally, even when we were not directly involved in the experiences being reported. We, therefore, made sure that basic emotional and mental health support was available to the reporting team. We also tried to recognize when the work was taking a toll and to give ourselves space to step away when needed.

Hypothesis

We hypothesized that Malaysian online child exploitation networks operate along two parallel tracks:

• Primary model: Organised groups or individuals profiting from the sale of AI-generated and non-AI child sexual abuse material.
• Secondary but crucial context: Peer-to-peer or child-led networks where minors themselves monetize explicit content, often normalizing abuse without adult orchestration.

Both models exploit the same gaps in platform accountability and legal enforcement, with financial incentives driving participation.

Data sources

The Royal Malaysia Police (PDRM): The Sexual, Women, and Children Investigation Division (D11) of the Royal Malaysia Police (PDRM) is the primary enforcement body for addressing child abuse. We sought their collaboration on this project. We submitted an inquiry regarding the following information: the number of cases reported each year, classification of cases, number of charges and prosecutions, number of convictions, the types of legal sections applied for each case category, and additional relevant data.

Malaysian Communications and Multimedia Commission: We sought official cooperation from the Malaysian Communications and Multimedia Commission (MCMC) for a few attempts, but they either declined or did not respond. Nevertheless, we managed to gather information from the Deputy Minister’s parliamentary responses and social media posts.

Internet Watch Foundation (IWF): The U.K.-based Internet Watch Foundation works to stop child sexual abuse online. It operates anonymous reporting portals in more than 50 countries and territories, and publishes annual reports with data and insights on online child sexual abuse material.

National Center for Missing & Exploited Children (NCMEC): The U.S.-based National Center for Missing & Exploited Children works to protect children from exploitation and abuse. Its CyberTipline provides an anonymous reporting channel, while its website publishes data, research, and resources on CSAM and child sexual exploitation.

Disrupting Harm in Malaysia Report: Disrupting Harm in Malaysia, produced by ECPAT International, UNICEF, and INTERPOL, provides an overview of how children in Malaysia use the internet, and the ways they may encounter online sexual exploitation and abuse. It also examines the scale of the problem, children’s experiences and the extent to which these harms remain underreported.

Recording social media data ourselves: Social media serves as a gateway to CSAM; we kept records of suspicious content and profiles of bad actors. Telegram, meanwhile, is a hotbed for the sale of illegal content; we manually recorded the necessary data and information ourselves, without relying on any additional tools.

Interviews: We conducted interviews with survivors, child’s rights advocates, researchers, lawyers, and experts.

What did we do?

As journalists, we are not law enforcement or investigative authorities. We do not have access to private platform data, IP addresses, private messages, user identities, or other information needed to identify people behind accounts. Our aim was not to identify every bad actor, but to show how the ecosystem works, where vulnerabilities exist, and how ordinary platform features can be misused to facilitate the exploitation of children.

Mapping the digital ecosystem

For the Telegram and TikTok story, we began by mapping how individuals and groups use different platforms to promote, distribute, or redirect users toward exploitative material involving children. The objective was not to identify a single organization behind the activity, but to understand how different individuals and groups use existing platforms to create and sustain networks. We did not publish specific search terms, channel names, account identifiers or other details that could help users locate illegal material or evade platform moderation.

Our approach

Tracing links from mainstream platforms

We monitored publicly accessible signals on X (formerly Twitter) and TikTok for posts advertising or linking to Telegram groups and channels associated with sexualized content involving minors.

We used multilingual search terms and hashtags across Malay, English, and Chinese, reflecting the languages commonly used by Malaysian users. We consulted young people with a stronger grasp of Gen Z language and internet culture; since bad actors have learned to weaponize emojis and coded language to evade AI moderation systems, the youngsters’ knowledge helped us locate relevant content far more effectively.

Some accounts linked to Telegram through their profile biographies (link in bio), posts, or other publicly visible information.

Within Telegram, publicly visible channel descriptions and pinned messages sometimes contained links connecting users to other channels, groups, bots, or administrator accounts. We captured publicly available evidence manually, recording URLs, usernames, engagement figures, payment methods, crypto wallet IDs, and relationships between links.

Examining automated services

We also documented publicly visible Telegram bots that advertised AI-generated or manipulated sexual content. Where a bot presented different functions or options, we examined the publicly displayed information to understand what the service claimed to offer and whether it provided terms, examples or links to external services. We did not use the services to generate or obtain illegal material.

Following the payment trail

Where payment information was publicly displayed, we recorded advertised prices, accepted payment methods and publicly visible transaction information. This included references to bank transfers, e-wallets, cryptocurrency, and other payment services. Where relevant, we documented payment QR codes, bank account numbers and cryptocurrency wallet ID to examine how payments were solicited and whether links could be identified between accounts or channels.

However, we could not independently verify who controlled these payment accounts or determine whether the account holders were alleged perpetrators, money mules or other intermediaries. The presence of a payment identifier in a CSAM-related channel did not, by itself, establish the account holder’s involvement in criminal activity.

Request for comment

We organized all evidence into a structured folder and submitted it to relevant parties, including Telegram, TikTok, and financial service providers such as Google Pay, Apple Pay, Alipay, and WeChat Pay, to seek their responses and understand what measures were available to detect and disrupt the activity.

What to expect

Use their T&C as our strongest lever: When holding big tech accountable, citing the specific clauses they are failing to enforce is far more effective than general criticism.

Allow at least two weeks for major tech companies to investigate and respond, and in most cases, it will take longer. Anticipate a back-and-forth process; follow up regularly and document every exchange. Persistence is part of the job.

Tech companies have both the visibility and the power to remove content, suspend accounts, or terminate services if they find bad actors exploiting their infrastructure to trade CSAM or purchase tokens to generate AI deepfakes. This is not a grey area; such conduct explicitly violates their own community guidelines and terms & conditions.

Keep a record of when we submitted evidence, what we submitted, and how the company responded. Advocate for more substantial action if necessary, as some companies may only provide official quotes without transparent information on how they engage with the relevant parties.

Identifying suspected AI-generated CSAM accounts on TikTok

Between February and March 2026, we identified 22 TikTok accounts that appeared to have bypassed the platform’s content moderation systems and continued to host or circulate potentially harmful material.

Recognizing that AI-CSAM can be challenging, as it may not always include explicit sexual behavior, we developed a set of indicators based on repeated patterns observed during our monitoring. These indicators were used to flag accounts for investigation; they were not, on their own, treated as proof that an account had violated the law or that every image was AI-generated CSAM.

The indicators included:

• Repeated posting of sexualized child-like imagery: Accounts that had posted more than three videos or images featuring child-like figures in adult-oriented or sexualized settings. This included figures dressed in bikinis or revealing underwear, sexually suggestive poses or camera angles resembling voyeuristic photography, and AI-generated figures displaying sexually suggestive behavior.
• Content remaining accessible over time: We checked whether the accounts and their content remained accessible on TikTok. We also examined the dates of comments and other visible engagement to determine whether older posts continued to receive views or interaction. In some cases, posts that were around a year old were still accessible and had received recent comments. This allowed us to examine whether older content could continue to circulate or be surfaced to users by TikTok’s For You page algorithm.
• External links in account bios: We checked whether the accounts included links in their profiles directing users to external websites, platforms, or messaging services. External links can provide a pathway from a mainstream social media platform to other online spaces.

We collected publicly visible engagement metrics, such as views, likes, and shares, to assess the reach and visibility of the reported material. By subscribing to SocialInsider, a social media analytics and competitor analysis tool, we monitored the growth of these accounts.

We also tested TikTok's reporting mechanisms and subsequently reported selected findings through the government’s MCMC complaints system. We submitted reports through the relevant platform reporting mechanisms and recorded:

• The date and time of each report
• The reporting category selected
• The response received
• Changes to the reported account or content
• The time taken for the platform to respond, where a response was provided

This created a documented timeline that allowed us to compare what the platform and regulator said they would do with what we could independently observe.

However, there are several limitations to this methodology:

• Incomplete picture: Online networks change quickly. Accounts can be deleted, renamed, or moved to private groups and encrypted platforms. Our findings reflect what we could observe during the reporting period and are not a complete map of all CSAM activity.
• TikTok algorithm: We could observe content available to users, but we did not have access to TikTok's internal recommendation systems, moderation tools, or data. We therefore cannot establish exactly why particular content was recommended or whether it was reviewed by TikTok.
• Sample size: The 22 TikTok accounts identified between February and March 2026 were selected based on repeated indicators we observed. They were not a representative sample of the entire platform and cannot be used to estimate the prevalence of AI-CSAM on TikTok.
• AI detection: Visual analysis and AI detection tools cannot, on their own, conclusively establish whether an image was AI-generated. We, therefore, considered multiple indicators and treated our findings as evidence of patterns rather than definitive legal findings.

The remaining stories followed a more traditional journalism approach. We shared our observations and findings with relevant authorities and experts for verification, fact-checking, and comment. Their responses helped us test our findings, provide context, and ensure the reporting was accurate, balanced, and properly qualified.

How this methodology can be replicated for other investigation purposes

This methodology can be adapted to other investigations involving online harms, not only CSAM.

A useful next step would be to examine the policy with practice; what a platform says it prohibits may differ from what users can actually encounter. Secondly, dive into the comment sections and the content of videos more closely. Comments may reveal how users encourage one another to produce or share similar material, while repeated phrases, coded language, hashtags, or other indirect signals may be used to avoid moderation or conceal the users’ real intentions.

The same approach can be applied across different platforms: Identify recurring indicators, document publicly visible patterns, trace how users move between platforms, and then verify the findings with experts, authorities, and the platforms themselves.