18/08/2026
Law enforcement agencies are closing down an increasing number of marketplaces, but bad actors aren't going away. Instead they’re meeting on other platforms, notably messaging app Telegram.
In one of the largest studies of its kind, researchers from the Cambridge Cybercrime Centre here and collaborators at Carnegie Mellon University CyLab spent a year monitoring communities on Telegram where stolen data was being traded. The team collected 14 million messages and 3.6 million shared files from 1,500 channels where log-in credentials, personal information, card details, etc, were being sold. They wanted to know how the criminals operate and what they're doing to evade detection.
Tina Marjanov, a PhD student here and first author of the research, says the use of Telegram by cybercrime communities has flipped the previous operating model (where criminals traded in large and long-established underground forums) on its head. It's also "making the whole cybercrime landscape more diverse," she says. The research has just been presented at the USENIX Security Symposium 2026.
👇
https://www.cst.cam.ac.uk/news/stayin-alive-how-global-stolen-data-markets-thrive-telegram