Inside the Telegram Ecosystem Selling Compromised and Fake Accounts

Background

The unauthorized buying, selling, and trading of compromised or fraudulent online accounts – known as “account trafficking” – is a persistent concern for platform trust and safety teams and cybersecurity professionals, who have seen illegitimately acquired or created accounts used to fuel a broad range of cybercriminal activities and digital security threats.

Sellers of trafficked accounts typically acquire them through illicit methods, like hacking or phishing, or create them using fake information, sometimes using stolen identities or forged documents. Trafficked accounts are often marketed in bulk quantities in niche communities tied to other forms of cybercrime, and are offered at various prices depending on their attributes (such as age, credentials, and verification status).

Beyond dark-web marketplaces and niche forum boards, trafficked accounts are also marketed to prospective buyers on the encrypted messaging app Telegram. Despite the company’s recent efforts to crack down on illicit activity on its platform, our research has repeatedly found that Telegram remains a top choice for cybercriminal networks selling stolen web data, advertising questionable software, promoting scams, and other nefarious activities.

Our Approach

Open Measures sought to better understand how account traffickers have used Telegram to promote the illicit sale of accounts on U.S.-based tech platforms, using our platform to analyze posts advertising buyable accounts that appeared in our datasets.

To identify Telegram posts tied to likely account trafficking networks, Open Measures built search queries designed to surface posts in our platform that named at least one major U.S.-based tech company or platform across seven industry sectors (1) and included language indicating the sale of accounts for those services (2).

Our searches targeted posts that named one of the companies listed below and contained the abbreviations “WTS” or “WTB” (shorthand for “want to sell” and “want to buy”) or included both a variation on the word “account” and a dollar sign indicating a sale price. We limited our search to posts shared between July 1, 2025, and July 1, 2026, capturing a yearlong period in our analysis.

The companies included in our search queries were as follows, grouped by sector:

• Payment Processing: Venmo, Cash App, Zelle, Authorize.net, Chime, Square, Stripe, PayPal

• E-commerce: Amazon, Ebay, Etsy, Walmart, Target, Wayfair, Poshmark, Depop, OfferUp, TikTok Shop, Instagram Shops, Newegg, BigCommerce, WooCommerce, Squarespace Commerce, Magento (Adobe)

• Social Media: Facebook, Instagram, Twitter/X, LinkedIn, Snapchat, TikTok, YouTube, Twitch, Discord, Reddit, Quora, Threads, Nextdoor, Tumblr, Pinterest, Bluesky

• Artificial Intelligence: Claude, Gemini, ChatGPT, Copilot, Grok, Perplexity AI

• Gaming: Steam, Epic Games, PlayStation, Google Play, App Store, Xbox, Nintendo, Roblox, Minecraft

• Dating: Tinder, Bumble, Hinge, Match.com, OkCupid, eHarmony, Badoo, Grindr, Scruff, AdultFriendFinder

• App Development: Google Play, Apple App Store (with explicit mention of “developer” or “dev”)

Messages in Telegram groups can be set to automatically delete after a preset period of time, and many of the groups where account trafficking posts appeared seemed to be employing the feature – likely to minimize group members’ digital trails and evade retroactive detection from Telegram moderators. Because Open Measures archives posts in these groups before they delete, we were able to review and analyze account trafficking posts over time, allowing for analysis that would otherwise be difficult or impossible to conduct.

What Account Trafficking Looks Like on Telegram

The posts in our datasets engaged in likely account trafficking were typically found in Telegram groups and channels that were self-styled as “over the counter” – frequently abbreviated as “OTC” – cryptocurrency trading groups, where users arrange peer-to-peer transfers of digital assets outside of public exchanges. But upon closer inspection, the “OTC” groups where posts appeared actually functioned as classified boards for black-market and grey-market goods and services.

Users soliciting accounts often used a rough template for their posts, including “WTS” or “WTB” to indicate whether they were looking to buy or sell accounts, listing desired or available accounts on desired platforms, and itemizing preferred methods of payment. Some posts included prices, while others invited prospective buyers to contact them privately.

Caption: A Telegram post shared on June 30, 2026, in a self-styled “over the counter” group advertised accounts for a host of platforms at “Affordable Prices.” The user directed interested buyers to contact them privately and join a separate Telegram channel. (Open Measures obscured the identity of the user and channel links from this screenshot.)

“Verified” and “Aged” Accounts

Posts from sellers often touted that the accounts they had available were “verified” or “aged”, making them more valuable to potential buyers seeking to exploit them for illicit or illegitimate purposes. Many of the posts advertising e-commerce and payment processor accounts claimed they were “KYC” (“know your customer”) certified, indicating that they had passed legally required identity verification steps.

Many of the posts we identified from users looking to purchase accounts from others stated that they were interested in purchasing them in bulk, with some offering premium rates for accounts that were aged or had higher numbers of followers.

Caption: A Telegram post shared on July 2, 2026, in a self-styled “over the counter” group solicited accounts for the dating platform Tinder. The user said they were interested in accounts from all countries and offered premium rates for older accounts. (Open Measures obscured the identity of the user and channel links from this screenshot.)

Some of the posts we identified advertised other illicit goods and services alongside likely trafficked accounts, including fraudulent identification and business documents, inauthentic boosting services for social media accounts, and more.

Likely Account Traffickers Shared Millions of Listings in Telegram Posts Last Year

Open Measures’ analysis identified more than 5 million Telegram posts in our datasets that advertised or solicited purchasable accounts for at least one of the dozens of U.S.-based tech companies and platforms included in our search queries. Many of the posts we surfaced advertised several at once.

Our datasets include archives for thousands of Telegram groups and channels, including many that appear to engage in cybercriminal activities, but they do not reflect the totality of Telegram – a massively popular app with billions of users around the globe. Resultantly, the groups and channels they contain provide only a glimpse at the broader ecosystem of account trafficking activity that may be affecting dozens of U.S.-based companies across a variety of tech sectors.

Of the 5,071,864 posts our search queries identified:

• About 83.2% named a payment processing platform (4,221,436 posts)

• About 32.7% named a social media platform (1,656,215 posts)

• About 26.7% named an e-commerce platform (1,354,015 posts)

• About 8.5% named an artificial intelligence platform (429,720 posts)

• About 5.7% named a gaming platform (289,286 posts)

• About 5.6% named a dating platform (282,118 posts)

• About 5% named a web development platform (252,522 posts)

Many of the posts we surfaced with our search queries included lists of accounts for multiple platforms. As such, some posts were counted for multiple sectors.

Using our platform’s Timeline tool to visualize the number of Telegram posts that matched our search queries over time revealed a sudden spike in daily volume in early September 2025. Over the two months prior, we surfaced only hundreds of posts per day from our datasets that matched our queries. From early September onward, the volume sharply increased to tens of thousands of posts per day, largely driven by a handful of accounts that showed signs of automated activity.

Caption: A Timeline chart shows the number of Telegram posts shared per day in Open Measures’ datasets that mentioned selling or buying accounts for at least one of dozens of U.S.-based tech platforms between July 1, 2025, and July 1, 2025.

We also saw a sharp drop-off in the daily number of posts in late October 2025. The reason for that sudden drop is also unclear, and this dip was not seen more broadly against the whole of our Telegram archives. But within a week of that crash, the daily volume of account trafficking posts rebounded. Since then, the daily volume of posts has remained relatively steady, seeing periods of rise and fall.

Sector-Specific Spikes of Likely Account Trafficking Activity on Telegram in 2025 and 2026

When breaking out the Timeline chart for each of the sectors included in our search queries, we saw that the volume of posts mentioning companies in each industry surged at different times. In December 2025, for example, we saw a sharp increase in the number of posts advertising or soliciting accounts for artificial intelligence, social media, dating, and gaming platforms.

Caption: A Timeline chart shows the number of Telegram posts shared per day in Open Measures’ datasets that mentioned selling or buying accounts for at least one of dozens of U.S.-based tech platforms, separated by unique sectors, between July 1, 2025, and July 1, 2025.

Telegram’s Account Trafficking Ecosystem Appears Driven By Bot Activity

Open Measures found that likely account traffickers appeared to be using Telegram’s bot integration features to scale and facilitate their illicit activities at volumes and frequencies that would be impossible for a human user to replicate. When reviewing posts matching our search queries, we encountered thousands of identical listings for buyable accounts that had been distributed across Telegram channels and groups at intense scales and speeds.

We used our platform’s Activity tool to count how many unique posts matching our search queries were shared by each account. We found that the 15 accounts responsible for the highest number of posts matching our queries shared a combined total of 935,648 posts, making up about 18.5% of all the posts our queries identified.

On closer inspection, we saw that most of the top 15 accounts we identified showed tell-tale signs of automation, sharing hundreds – and sometimes even thousands – of identical posts per day. They uploaded content at all hours for weeks on end, with no apparent breaks for rest. And some saw sudden drop-offs in activity, indicating they may have been abandoned by their creators or taken down by Telegram moderators.

Caption: An Activity chart shows the number of posts matching our search queries for likely account trafficking posts made by each of the 15 accounts that appeared most often in our query results.

Researchers also observed that total daily activity across the top 15 accounts first ramped up in September 2025: the same period we saw overall activity surge in our datasets. On Sept. 20, 2025 – the day with the highest number of posts matching our query that we recorded – the top 15 accounts we identified contributed about 31.5% of all the posts we identified in our analysis period. This indicates that automated accounts contributed significantly to the total number of posts we identified in our analysis.

Caption: An Open Measures Timeline chart showing the total number of posts in our datasets that matched our search queries for likely account trafficking activity (in red) as compared to the volume of posts made by the top 15 accounts we identified (in green) over our entire analysis period (July 1, 2025 to July 1, 2026).

Likely Account Trafficking Activity Was Highly Concentrated in Specific Telegram Channels

When we used the Activity tool to filter the results of our search query by the channels and groups where posts appeared, we found that the 15 channels that saw the highest number of messages matching our search query were responsible for the majority of the activity we identified. More than 55% of all the posts our searches identified appeared in one of those 15 channels.

Caption: An Open Measures Activity chart shows the top 15 Telegram channels that contained the greatest number of posts matching our search queries for likely account trafficking activity during our analysis period (July 1, 2025 to July 1, 2026).

After re-charting these results against all posts that matched our search queries in our analysis period, we also saw that the top 15 channels’ activity closely followed the larger trends reflected in our datasets.

Caption: A Timeline chart shows the number of posts matching our search queries for likely account trafficking posts that appeared in the top 15 channels we identified (in green) against all posts matching our queries in Open Measures’ datasets during our analysis period (in blue).

These findings indicate that automated accounts and hyper-active groups and channels played an outsized role in driving likely account trafficking we observed in our datasets, highlighting how traffickers can exploit Telegram’s unique features to further their illicit dealings on the platform.

Our Take

Cybercriminals have centered operations on Telegram for years, drawn to the platform’s unique features, privacy protections, and ease of use. Our findings paint an alarming picture of likely account trafficking on Telegram, a niche economy whose participants use the platform’s automation tools to advance their own likely illicit activities.

Without further investigation, it is difficult to say whether the posts we identified were legitimately offering the accounts they listed for sale. That research is best left to cybersecurity professionals and legal investigators. But if even a fraction of the posts we identified represent authentic exchanges of compromised or fake accounts, they present a serious risk for the dozens of companies and platforms they mention.

Recent political developments around the world, like age-limited restrictions on social media platforms, could drive this underground market further – creating additional incentives for cybercriminals to acquire and sell inauthentic accounts through illicit means.