How Criminals Turn Telegram Into a ‘Dark Mall’ for Child Sex Abuse Material

Baca dalam Bahasa Melayu

以中文閱讀

Warning: This article contains information about child sexual abuse.

X (formerly known as Twitter), TikTok, and Telegram — these three dominant social media platforms have a combined total of more than 100 million users globally. But they are also being exploited by perpetrators as a platform to produce, distribute, and trade child sexual abuse material (CSAM).

Perpetrators post sexually suggestive video content on X or TikTok, luring users to Telegram to purchase CSAM. They also use AI chatbots to generate nudes using photos of real-life people, which take merely five minutes to make.

Since there are practically no technical barriers, users now need not venture into the dark web. They can simply click through links that pop up on their social media accounts that will take them to a virtual playground of sexual offenders. They also now have the ability to create customised sexual exploitation content.

---

As a nonprofit journalism organization, we depend on your support to fund more than 170 reporting projects every year on critical global and local issues. Donate any amount today to become a Pulitzer Center Champion and receive exclusive benefits!

---

In other words, X and TikTok serve as the entrance for a shopping mall by marketing and driving traffic to Telegram, which acts as the mall where the actual CSAM transactions take place, according to an investigation by Malaysiakini between October 2025 and June 2026.

These Telegram groups and channels vary in size from several hundred members to 20,000.
1 icon = 100 people (below).

20,000 members is the maximum capacity of Stadium Merdeka (below).

X: A blurred surveillance line

Elon Musk’s X enables users to post adult content on their accounts. Since May 2024, when X officially updated its adult content guidelines, it announced that: “You may share consensually produced and distributed adult nudity or sexual behaviour, provided it's properly labelled and not prominently displayed.”

X claims it believes in adults’ autonomy to engage and create content that reflects their beliefs and desires.

You may share consensually produced and distributed adult nudity or sexual behaviour, provided it's properly labelled and not prominently displayed.

X Help Centre, May 2024

Although the platform stressed that distributing sexual exploitation, objectifying underage individuals, or engaging in non-consensual sexual activities are strictly prohibited, Malaysiakini’s investigation found that X adopts a highly permissive stance when it comes to sexual content.

When non-explicit underage-related keywords are typed into X’s search engine, several results pop up related to underage or sexually explicit visual content.

Users can view such content by simply clicking “I’m 18 years old” from a pop-up window.

One of the posts contained text that read:

“VVIP Malay group, direct message (DM) the admin on Telegram to join,” together with links to a few accounts.

During the period of investigation, similar searches conducted in Malay or Chinese yielded similar results.

TikTok: Black-hatting the algorithm

Even though TikTok strictly restricts nudity, sexual services, and underage-related sexually suggestive content, Malaysiakini found that it does not halt bad actors who expertly avoid the algorithm’s red flags to market their Telegram group.

These accounts often repost short clips of young women taken from other social media platforms and redistribute the content on TikTok without their creators’ permission. The underlying goal remains the same: to sexualise women.

Perpetrators utilised hashtags to precisely engage their intended audience. In Malay, the term “awek” is often used to describe girlfriends or pretty ladies.

When hashtags like “awektiktok,” “aweksekolah” (campus belle), or “awektudong” (hijab-wearing beauties) are placed alongside daily content such as girls at a pool party or dancing in front of mirrors, once-innocent clips are suddenly imbued with a voyeuristic, sexual undertone.

The comment sections are also full of “I want this girl” or other meme stickers with sexual undertones.

These accounts aggressively repost attractive female reels to gain traffic, luring users to click external links that are in their bios.

Whether on X or TikTok, these funnels all lead to the same base camp for CSAM: Telegram.

Telegram: A marketplace that’s hard to monitor

Russian Pavel Durov founded Telegram in 2013 as an instant messaging tool. For years, its minimal content oversight standards have allowed it to become a haven for cybercrime and the sale of contraband.

Telegram provides a free, unlimited cloud storage service. If one pays and subscribes as a Telegram Premium user, they can simultaneously manage hundreds of enormous groups and channels, which significantly facilitates criminal activity.

There are four main types of chat windows in Telegram: channels, groups, one-on-one direct messages, and the bot.

Malaysiakini’s investigation found a channel nicknamed “PS” that frequently posts a victim’s full-face photo, paired with thumbnails featuring exposed genitalia — some of the photos are of girls wearing the Malaysian school uniform.

Once a user messages an admin directly, they’ll receive a list that includes videos filmed surreptitiously, influencer-style visuals, and CSAM. Subscription fees for various types of groups range from RM10 to RM80.

Channel administrators even promote an RM100 “one-stop” package, which is exclusively available via a one-time purchase. Some traders even promise “to update daily,” and they create backup groups to avoid being reported.

What is truly chilling is that, despite being a grave legal offence, CSAM materials are not sold at a premium price. With only RM10, offenders can acquire 50 such videos.

Other than the channel “PS,” a CSAM group nicknamed “VM” represents a far more extensive and fully developed hierarchical supply chain. It is a pyramid of exploitation: consumers at the base, middlemen earning commissions in between, and suppliers at the top providing the source.

To build credibility, admins will also create a “feedback channel,” publicly displaying buyers’ transaction screenshots.

During Malaysiakini’s investigation, the total income broadcast in five feedback channels ranged between RM855 and RM3,140; all of the transactions were completed via local bank transfers.

According to the payment methods and currency stated on the receipts’ screenshots, Malaysians are not the only target audience — there were also Indonesians. Once payment is confirmed, agents will send buyers links to the groups, which contain CSAM.

Telegram AI bot: Create your own CSAM

At the end of 2025, the exploitation of generative visual content spiked globally due to Musk’s Grok AI, which can generate adult content. It has capitalised on this traffic by introducing a paid subscription model, requiring users to pay for generative images.

In fact, even before there was Grok AI, there was already an influx of so-called deepfake face-swapping and stripping bots powered by AI on Telegram.

One of the Telegram groups Malaysiakini discovered promoted an AI stripping bot with the description: “Free and easy-to-use AI video face-swap bot. 100% free with no top-ups required. Incredible results!”

Based on the example provided by another bot, 90 percent of the AI-generated content features women; only a very small number of male celebrities have been stripped.

These examples represent the evolution of generative AI images. In the past, AI could only create immobile images with visible flaws such as heads that do not match their bodies. This then evolved into generating three-second GIFs, and today, the creation of professional-looking videos with smooth and convincing camera movements.

Furthermore, the shortcut keys of the evolved version have descriptions with more explicit sexual intercourse positions or female clothing. Users are able to upload a still image and transform it into a three- to 10-second video with a few flicks of the thumb.

Telegram doesn’t officially own these bots, as anyone can easily build one by using a no-code platform or by coding it in Python.

While many platforms offer “no-code” convenience, achieving true “deepfake” quality remains out of reach for the average person. This is because the process shifts from simple logic codes to a heavy reliance on expensive GPU compute and complex algorithm integration, which requires professional server support.

Telegram’s official guidelines do not strictly ban all deepfake AI bots. The bot only has to adhere to the general terms of service, which prohibit illegal content such as distributing child sexual content, spam, or scams.

But in reality, it’s far from that.

In April, Europe’s non-profit organisation AI Forensics exposed that Telegram has an enormous cross-border operation network, with around 25,000 users trafficking non-consensual explicit content, including CSAM.

The report concludes that Telegram’s business model relies heavily on user engagement and subscription revenue. Since high-traffic channels generate significant advertising and paid conversions, the platform has a limited incentive to curb the spread of illicit content.

Consequently, Telegram said that it uses AI to detect and curb illegal content such as CSAM and terrorism by processing users’ reports. But, according to Durov, with an elite team of only 30 engineers, Telegram is hopelessly understaffed to manage 55 million daily active users.

This small workforce is a mere drop in the bucket, making it impossible to proactively monitor how AI bots are being utilised; intervening only after users raise a red flag.

Funding the underground: How Telegram Stars and cryptocurrency co-exist

“MUB,” a stripping bot with more than 20,000 subscribers, generates AI stripping content for RM1.24 per photo, Malaysiakini’s investigation found.

It accepts all kinds of top-up methods, including cryptocurrency, Alipay, WeChat Pay, Telegram Star, PayPal, as well as bank transfers and e-wallet payments to a local agent.

Telegram states in its Terms of Service for Bots that the platform will not process any payment transactions, and these will be handled by a third-party payment provider.

“Telegram does not handle, manage, oversee, verify, or provide any sort of warranty over such transactions.”

However, Telegram’s platform introduces a digital currency, Telegram Star. It enables direct transactions within Telegram, allowing users to pay for digital goods, creators’ premium content, and much more.

When purchasing Telegram Stars through Google Play or Apple, the latter acts as processors that integrate and support multiple local payment methods, including Shopee Pay, Touch 'n Go, Boost, and FPX, allowing users to choose their preferred payment channel through these platforms.

Telegram steers users toward its proprietary payment ecosystem by setting high prices on app stores, such as Apple and Google, to cover the 30 percent “platform tax,” while simultaneously offering lower-priced channels for payments made via The Open Network (TON).

The price varies from RM11 to RM200 for the top-up package of the AI stripping bot. Users can also accumulate points for free by checking in daily.

According to the photos’ watermark provided by deepfake victims from Foon Yew High School in Kulai, Johor, that Malaysiakini sighted, the offenders used the MUB bot to create some of the deepfake photos.

Although revenue from alternative payment streams remains opaque, on-chain forensics allows us to peek into the operation by analysing blockchain ledger entries.

A total of 18,291 of Telegram cryptocurrency valued at about US$4,207 (RM16,709) was funnelled to the bot’s e-wallet via 213 separate transactions.

This is equivalent to four of the common Modenas Kriss 110 motorcycle, which costs about RM4,000 each.

This cryptocurrency wallet was active from June 2025 to January 2026, during which the owner simultaneously cashed out nine times between September and December. After they withdrew the full amount on Dec 30, this wallet was deactivated.

When contacted for a response, Apple told Malaysiakini that the company has zero tolerance for CSAM or other similarly abhorrent content.

Based on evidence provided by Malaysiakini, Apple identified a Telegram channel directing users to an external AI adult-content website, where credits could be purchased using Telegram Stars and payment methods including Apple Pay.

The company said this arrangement violates its Apple Pay Acceptable Use Guidelines, and access to Apple Pay for the chatbot's checkout process is being disabled.

Apple also confirmed that it has contacted the developer, citing potential violations of its policies on sexual content, in-app purchases, and chatbot services. The company stressed that developers are responsible for ensuring that all content and services offered through their apps comply with App Store rules and applicable laws.

According to Google, the company maintains strict developer policies that prohibit apps and developer accounts containing sexual content. Google said that when violations are identified, it may take enforcement measures ranging from restrictions to the suspension or termination of developer accounts.

Regarding the Telegram bots highlighted by Malaysiakini, Google said it investigated the matter, contacted the relevant developer, and that the bots identified in the investigation have since been removed.

In response to Malaysiakini's enquiries, Alipay said it uses risk-control systems and reporting channels to monitor misuse of its services and may suspend transactions or restrict accounts where abuse is detected.

However, the company did not directly address the portal’s questions on whether its payment infrastructure had been used to facilitate transactions linked to the Telegram bot identified in the investigation, nor whether it had visibility over such transactions.

Telegram and WeChat did not respond to Malaysiakini's requests for comment by the time of publication.

Accountability: Struggling between surveillance and big tech

Bukit Aman’s Sexual, Women and Child Investigation Division (D11) principal assistant director Siti Kamsiah Hassan admitted that Telegram is a law enforcement blind spot.

“D11 does not have enough trained police officers to carry out undercover operations for the time being, but we’re cooperating closely with other experienced professional organisations to investigate these cases,” she told Malaysiakini during an interview.

Our lack of manpower limits us in carrying out daily trace investigations. Despite this, whenever the public reports to us and provides links, D11 will conduct in-depth investigations.

Siti Kamsiah Hassan, Bukit Aman’s D11 principal assistant director

In Budget 2026, the government allocated RM20 million specifically for D11 to curb online underage sexual exploitation cases.

Siti Kamsiah said that there are plans for D11 to train more undercover police officers this year to investigate these groups.

“Undercover officers are required to be systematic and focused while investigating, and it’s also vital for them to be skillful when interacting with criminals.

“Online criminals are resourceful at hiding their data and identity. They operate within private chat groups that are shielded by a rigorous multi-stage vetting process for new members.”

Malaysia is not the only one that’s facing this problem with Telegram. The platform is now facing legal scrutiny in many countries due to its lax attitude towards illegal content.

In August 2024, Telegram's 40-year-old founder Durov was arrested in Paris, France, and prevented from leaving the country during the investigation.

French authorities accused Durov of allegedly being an accomplice in crimes by managing an online platform that encourages illegal activities, such as trading CSAM and drugs, facilitating scams, and being non-compliant with law enforcement requests.

After Durov had been investigated in France for four months, Telegram agreed to work with the Internet Watch Foundation (IWF) to curb the distribution of CSAM.

The IWF is a globally renowned online regulatory organisation that assists large-scale online service providers in detecting and removing CSAM.

Before this, Telegram had refused to cooperate with the IWF or any other similar initiatives.

Nevertheless, there’s a big gap between the promises of policies and actual implementation.

Even though Telegram expressed a willingness to cooperate, a February 2025 investigation by Brazilian investigative website Nucleo found that Telegram Stars can still be bought to use bots to generate CSAM.

In March 2025, Durov was allowed to leave France despite the ongoing investigation. At the time of writing, there’s no news on his prosecution or sentencing.

Months later, Malaysia also cracked down on Telegram. In June 2025, MCMC sued Telegram and its channels, Edisi Siasat and Edisi Khas, accusing them of breaching the Communications and Multimedia Act 1998 for disseminating false, inciteful, and harmful content that threatens public order. However, before they were shut down, these two channels did not appear to distribute CSAM.

This was the first instance of Malaysian authorities going after social media platforms. The court granted MCMC’s application for an Erinford injunction, restraining Telegram Messenger Inc and the administrators of Edisi Siasat and Edisi Khas from publishing or disseminating 33 articles that were deemed harmful.

In November that year, the channel’s administrator failed to appear in court, and MCMC obtained a default judgment from the High Court, with the amount of damages to be determined.

Malaysia opts for a more straightforward strategy by banning certain platforms when it comes to new threats of AI-generated CSAM.

On Jan 11, 2026, MCMC announced that users are restricted from accessing Grok within Malaysia, stating that it has been used to generate obscene and highly offensive content, including AI-generated visuals without proper consent.

On Jan 23, the temporary block on Grok was lifted following confirmation of the implementation of additional preventive and security measures by the platform.

The experience with these platforms indicates where the weakness lies when it comes to combating CSAM — if certain platforms favour business interests and choose a hands-off approach, it will be very difficult to stop its dissemination and other illegal content.