Following crackdown and removal of over 43.5 million channels and groups in 2025, millions of Telegram users face rising cyber threats in 2026.

This was revealed by Check Point Software Technologies in a new report, which found a surge in attacks despite daily takedowns reaching as high as 140,000 and peaking above 500,000 in a single day.

The report noted that despite that, cybercriminal networks continue to operate largely uninterrupted, adapting quickly to enforcement measures.

Check Point noted that Nigeria, which has one of the largest Telegram user bases in Africa with an estimated eight million users, was particularly exposed.

The platform’s popularity for cryptocurrency trading, online betting, and digital commerce makes it a key target for fraudsters and illicit operators.

The report showed that enforcement actions, while significant, have not reduced the presence of cybercriminal communities.
Instead, these groups have evolved, creating backup channels in advance and rebuilding networks almost immediately after takedowns.

Country Manager, West Africa, Check Point Software Technologies, Kingsley Oseghale, said: “Rather than disappearing, these illicit ecosystems are reorganising, evolving, and staying one step ahead, underscoring a growing paradox: Telegram’s enforcement is record-breaking, but the threat landscape is not shrinking.”

According to the report, cybercriminals are also deploying more sophisticated tactics to evade detection.

These include restricting access through “request-to-join” features, using misleading disclaimers, and operating multiple parallel channels to ensure continuity.

The report noted that attackers now anticipate disruptions and build redundancy into their operations, making enforcement less effective in dismantling entire networks.

Check Point said it noticed spikes in forwarded messages referencing blocked sources, especially during peak enforcement periods in February, March, and April 2025.