Apple briefly removes Telegram as Durov alleges a takedown extortion attack

Why it matters

The incident shows how one malicious upload can threaten an app's distribution, giving Apple direct leverage over even the largest user-generated-content platforms.

Apple briefly removed Telegram from the App Store late on August 3rd after finding child sexual-abuse material on the messaging service, then restored the app within hours after Telegram deleted the content and banned the user who posted it.

Telegram founder Pavel Durov (@durov) described the removal in a post on X on August 4th. Durov, who previously co-founded the Russian social network VK with his brother Nikolai, launched Telegram in 2013 and remains its owner and CEO. Telegram says the Dubai-based service passed 1 billion monthly active users in 2025.

An Apple spokesperson confirmed the removal and restoration to Reuters. Apple said its review found material that violated rules prohibiting child sexual abuse material and that Telegram acted by removing it and banning the user responsible. Telegram's US App Store listing was live again on August 4th.

Durov offered a more elaborate account of how the prohibited material reached a public Telegram group. In a longer statement on his Telegram channel, he said the user edited an old message in an active group to insert AI-modified illegal sexual imagery. The edit allegedly made the content difficult for group members to notice and report.

Durov characterized the user as a "takedown extortionist" who placed illegal files in communities and threatened their owners with App Store reports unless they paid a ransom. He said automated accounts can be used to seed the material and report it directly to Apple.

The extortion account rests on Durov's allegation. Apple's account establishes that the prohibited material was present and that Telegram removed it and banned the account. It does not establish who planted the material, whether money was demanded or whether the incident was part of a coordinated campaign.

Apple's rules put the burden on Telegram

Apple's App Review Guidelines require apps hosting user-generated content to filter objectionable material, provide reporting tools, respond to complaints and let users block abusive accounts. Apple says developers are responsible for removing violating content and may lose App Store distribution until they can demonstrate compliance.

That structure gives Apple an immediate enforcement mechanism against services it does not operate. A bad actor does not need to disable an app's infrastructure to interrupt its distribution. Placing prohibited material inside a user-generated-content service can force the app developer into an emergency moderation and appeals process with Apple.

Durov argued that removing Telegram before contacting its operators created a risk for every large community app. The episode also exposed Telegram's own risk: its public groups and editable message history offer an attacker surfaces that private, closed messaging products may not provide at the same scale.

Telegram says it combines user reports, automated hash matching, machine learning and outside reports to police public content. Its safety dashboard listed 337,942 CSAM-related groups and channels blocked during 2026 as of August 4th. That figure is self-reported and measures enforcement actions rather than the total volume of prohibited material uploaded to Telegram.

The removal comes during broader scrutiny of Telegram's moderation. On April 21st, the UK's Ofcom opened an investigation into whether Telegram has complied with duties to prevent users from encountering child sexual-abuse material, reduce the risk of its distribution and remove it quickly. The regulator said it had gathered evidence from its own assessment and the Canadian Centre for Child Protection. The investigation has not reached a finding.

Telegram has faced the same distribution sanction before. In February 2018, Apple temporarily pulled Telegram after confirming that child sexual-abuse material had been distributed through the service. Apple restored the apps after Telegram removed the content, banned the users involved and added controls intended to prevent another occurrence.

The August 2026 incident ended quickly, limiting the immediate effect on Telegram users. Its significance lies in how little technical access Apple needed to exert pressure. Apple did not have to block Telegram's servers or disable existing installations. Control over new downloads and reinstalls was enough to force a platform serving more than 1 billion users to act within hours.