The year 2025 saw a seismic event in the tech sphere when Telegram’s founder, Pavel Durov, faced arrest in France amidst claims of platform misuse. This incident sent shockwaves globally. For years, Telegram had long cultivated an image as the premier application for secure, encrypted, and resilient communication, drawing in close to a billion users worldwide, ranging from political dissidents to individuals seeking basic privacy.

However, the very privacy features that define Telegram — end-to-end encryption, anonymous profiles, and robust bot integration — have inadvertently fostered an environment ripe for exploitation by cybercriminals, fraudsters, and even state-sponsored hacking groups. This paradoxical reality underscores the platform’s complex role in the digital landscape.

Telegram has evolved beyond a simple messaging service; it now functions as a bustling digital marketplace, a surrogate for dark web activities, and a major arena for cyber warfare. The platform’s immense popularity is being leveraged by malicious actors for everything from intricate malware deployments to cunning social engineering ploys, all operating at an alarming scale.

For regular users, encountering various Telegram scams is increasingly common. While some may have evaded these traps, the sophistication of these schemes is advancing rapidly, sometimes even circumventing direct user interaction.

With a user base exceeding 900 million, Telegram’s widespread adoption brings inherent risks. The year 2025 has been particularly challenging, seeing the app become a primary target for hackers, scammers, and government-backed entities. From Android zero-day exploits to social engineering scams, the platform has navigated one of its most perilous periods.

This article will delve into some of the prevalent scams and hacking techniques currently active and outline immediate protective measures you can take.

1. EvilLoader

Among the most concerning Telegram exploits of 2025 is ‘EvilLoader,’ a significant zero-day flaw still present in Telegram for Android (version 11.7.4).

This attack method involves disguising harmful APK files as benign video content exchanged within chats. When a user clicks such a file, Telegram prompts them to “open externally.” Rather than playing a video, the malicious software surreptitiously installs itself on the device, subsequently gaining access to files, communications, and even financial applications.

Since this vulnerability remains unaddressed by Telegram, millions of users are still exposed. Cybercriminals are openly marketing EvilLoader exploitation kits on illicit online forums, marking it as a critical and ongoing threat for Telegram users in 2025.

Security Advisory: Refrain from installing or executing any files received via Telegram chats unless you can absolutely verify the sender’s trustworthiness.

2. Telegram Name Scam

April 2025 saw LearnHub Africa bring to light a rapidly spreading fraudulent scheme known as the ‘Telegram Name Scam.’

This scam capitalizes on the desirability of unique, concise, or “premium” Telegram usernames, which are often traded or sold on marketplaces like Fragment. Perpetrators entice victims with offers to “buy” or “sell” usernames, ultimately deceiving them into surrendering full control of their accounts.

Tactics include phishing links or convincing users to temporarily transfer ownership, leading to permanent account hijacking. Frequently, the scammers will then demand a ransom for the account’s recovery.

Distinct from technical exploits, this particular scam operates on the principles of social engineering, exploiting human tendencies towards trust and avarice.

Security Advisory: Never engage in the transfer of your Telegram username or respond to any unsolicited propositions regarding it. Safeguard your username with the same diligence you apply to your password.

3. Lazarus Group’s Telegram Malware Campaign

In 2025, the infamous Lazarus Group, originating from North Korea, broadened its cyber warfare strategies to include Telegram as a key component.

Investigations by security experts revealed that Lazarus-linked malware families were employing Telegram channels for command-and-control (C2). This setup allowed compromised devices to communicate with Telegram bots or channels, facilitating the reception of commands and the exfiltration of sensitive information.

The group’s primary targets encompassed:

• Cryptocurrency investors
• Professionals in the FinTech sector
• High-level business executives

Given Lazarus’s history of orchestrating multi-billion dollar cyber thefts, their utilization of Telegram significantly complicates efforts to detect and dismantle their operations.

Security Advisory: Individuals managing crypto or sensitive data should employ dedicated devices and conduct routine malware scans.

4. Weaponized Telegram Bots (PXA Stealer)

During 2025, a cybercrime syndicate with Vietnamese linguistic ties exploited Telegram bots to automate extensive data exfiltration.

Their modus operandi involved:

• Deceiving victims into installing counterfeit “Word” or “PDF reader” applications.
• These applications secretly contained PXA Stealer, a malicious program designed to collect passwords, browser cookies, and credit card details.
• The pilfered information was then directly transmitted to Telegram bot channels, providing attackers with immediate access.
• Compromised credentials were subsequently traded through clandestine services such as Sherlock and Daisy Cloud.

This incident vividly illustrates how malicious actors are repurposing Telegram’s legitimate bot infrastructure for industrial-scale cybercriminal activities.

5. Hikka Userbot Exploit (CVE-2025-52571)

January 2025 marked the revelation of a major security flaw within the Hikka Telegram userbot, a popular tool for community automation.

Versions preceding 1.6.2 were found to harbor a vulnerability enabling unauthenticated attackers to:

• Seize control of the userbot.
• Compromise the associated Telegram account.
• Establish command over the server hosting the bot.

Consequently, users operating outdated Hikka bots unknowingly provided attackers with full access to their accounts and server environments.

Security Advisory: Ensure all Telegram bots you use are regularly updated, or consider deactivating them if their function is not essential.

6. Criminal Channels: A Hub for Illicit Trade

A 2025 academic analysis of 339 Telegram channels associated with criminal activities highlighted the platform’s emergence as a vibrant black market for cybercrime:

• Approximately 28% of shared links were found to direct users to phishing sites.
• A substantial 38% of executable files distributed contained various forms of malware.
• Criminals were observed marketing their illicit “products” with incentives such as discounts, giveaways, and even offering pseudo-customer support.

This demonstrates that Telegram is not only a target for cyberattacks but also serves as a central clearinghouse for malicious actors to exchange tools and enlist collaborators.

7. 16 Billion Credentials Exposed

June 2025 brought the unsettling revelation of one of history’s most massive credential leaks: an astonishing 16 billion usernames and passwords, pilfered through infostealer malware.

This vast trove included numerous Telegram accounts. Attackers could directly access victims’ accounts, particularly if two-factor authentication (2FA) had not been activated.

While not a direct breach of Telegram’s systems, this incident underscores the significant risk Telegram users face from widespread third-party data compromises.

Security Advisory: Activate two-step verification within Telegram’s settings (Privacy & Security -> Two-Step Verification). Failing to do so leaves your account vulnerable to takeover with just a single stolen password.

8. Animated Sticker Vulnerabilities Across Platforms

February 2025 saw security experts from Shielder reveal that even animated stickers could be weaponized.

By exploiting Telegram’s internal rendering mechanisms, specially crafted malicious stickers were capable of achieving unauthorized access to media files in encrypted chats. This cross-platform vulnerability impacted Android, iOS, and macOS clients.

Although Telegram has since deployed a patch for this defect, it served as a stark reminder that even seemingly harmless features, such as animated stickers, can conceal significant security dangers.

9. SIM-Swap Hijack: The Fall of VChK-OGPU Channel

April 2025 witnessed the dramatic hijacking and subsequent deletion of one of Russia’s largest independent Telegram channels—VChK-OGPU, boasting over a million subscribers.

Reports indicate that attackers executed a SIM-swap attack, effectively cloning the mobile number associated with the channel’s account. Upon gaining entry, they assumed full control and eradicated the channel’s content.

For accounts with a high public profile, SIM hijacking continues to be a formidable threat on Telegram, largely due to the reliance on phone numbers for verification processes.

Security Advisory: Contact your mobile carrier to request SIM-swap protection, or consider utilizing an eSIM if supported by your device and provider.

10. ShinyHunters’ Extortion Campaign via Telegram

The notorious hacker syndicate, ShinyHunters, employed Telegram as a central component in a significant extortion plot targeting the UK’s Legal Aid Agency in 2025.

The group purloined over two million confidential records, issuing threats to release this data unless their demands were satisfied. Telegram channels were strategically utilized by the group to broadcast their threats and convey ransom specifics.

Although the stolen data was not ultimately leaked post-deadline, this incident underscored how Telegram doubles as a tool for cyber blackmail.

Social Engineering

Although technical vulnerabilities often dominate news cycles, social engineering scams are the most insidious threat. These schemes bypass conventional security measures like firewalls and software updates by exploiting human psychological weaknesses.

1. Impersonation Fraud

In a striking example, a crypto investor suffered a loss of 783 BTC ($91 million) after falling victim to attackers impersonating hardware wallet and exchange support staff. Identical deceptive strategies are prevalent on Telegram, where fraudsters masquerade as insiders or “admins.”

2. Malicious Bots

Reddit users warn of bots that phish OTPs, CVVs, and PINs directly in Telegram. Victims are manipulated into clicking links and divulging sensitive information almost instantaneously.

3. Tailored Deception

Modern scammers frequently employ personalized touches, such as using victims’ first names and crafting bespoke greetings, to enhance their credibility. As one Redditor observed: “Telegram scammer mentioned my first name… profile setup looked real enough.” The key insight here is: if an interaction feels unusually personal, it is likely a deliberate manipulation.

Key Insights for 2025

• App Vulnerabilities: Technical exploits (EvilLoader, Hikka, sticker flaws) underscore inherent weaknesses within the Telegram application itself.
• Human Factor: Social engineering techniques (Telegram Name Scam) consistently demonstrate that human users remain the most susceptible point in the security chain.
• Global Cyber Conflict: The involvement of nation-state actors (Lazarus Group) illustrates Telegram’s integration into the broader landscape of international cyber warfare.
• Illicit Digital Hubs: Criminal marketplaces thrive openly in Telegram channels.
• Widespread Risks: SIM-swaps and extortion campaigns highlight significant dangers for both individual users and larger entities.

Immediate Steps for Self-Protection

• Enable 2FA in Telegram → Settings → Privacy & Security → Two-Step Verification.
• Regular Software Updates to apply the latest security patches.
• Exercise Caution with Unknown Content: Be extremely wary of links, files, and stickers from unverified contacts.
• Decline Username Offers: Avoid username trades or “premium handle” offers.
• Strong, Unique Passwords with a password manager.
• Secure Your SIM Card: Contact your mobile carrier about SIM-swap locks.
• Maintain Awareness: Stay informed—scammers evolve faster than platforms can patch.

Conclusion

While Telegram’s exponential growth has cemented its status as a global digital giant, the events of 2025 undeniably demonstrate its vulnerability as a prime target. The spectrum of threats, from sophisticated Lazarus Group’s cyber-espionage campaigns to prevalent social engineering schemes such as the Telegram Name Scam, is expanding in both magnitude and ingenuity.

The overarching message is unequivocal: Telegram is not immune to attack. Security is not an inherent feature but rather an ongoing responsibility that every user must proactively embrace.

For anyone utilizing Telegram in 2025, immediate action is paramount. Update, enable 2FA, and stay vigilant because hackers are moving faster than ever.