How Telegram Spam Changed in 2026 — and Why Your Defences Didn't

How Telegram Spam Changed in 2026 — and Why Your Defences Didn't

Most Telegram group defences were designed against an attack that has largely been replaced.

The old attack was loud: an account joins and immediately posts a link. Captcha at the door handles it. That is what almost every anti-spam setup is still configured for.

The current attack is patient, and it walks straight past that door.

The numbers

The figures below come from different sources measuring different things, over periods from 2020 to early 2026. They do not corroborate each other; each is dated so you can judge how current it is:

That last figure cuts both ways. Telegram is acting at enormous scale, and the volume it is acting against is enormous too.

What actually changed

Attacks got patient. Coordinated join raids now push waves of fresh accounts from cheap bot farms that join, wait a random interval, then start dripping links. The delay is deliberate and it is aimed precisely at entry-gate defences. An account that solves your captcha and stays quiet for three days has defeated your entire anti-spam stack, and your logs will record a successful verification.

Captcha stopped being a filter. Farms have humans and solving services. See captcha types compared. Treating a solved captcha as evidence of legitimacy is the core mistake of the current era.

Impersonation got specific. Phishing bots posing as "TON Giveaway" or "Wallet Support" drain funds through malicious contracts. These are not generic spam — they impersonate infrastructure your members already trust.

Invite bombing became routine. Users are added to groups they never joined, then worked on by accounts posing as ordinary enthusiastic members. The group itself is the attack surface.

AI lowered the cost. Generated messages that read naturally, in the group's own idiom, defeat keyword filters that used to catch obvious pitches.

Why your defences didn't move

Most groups run: captcha on join, keyword filters, admins who remove reported spam.

Each maps to the old attack.

Captcha checks the moment of entry. The new attack passes it honestly and attacks later.

Keyword filters catch known phrases. AI-generated pitches don't reuse phrases, and attackers test against public filter lists.

Reactive removal happens after members have seen the message. In a large group, "after" is minutes — long enough for the message to do its work.

The common flaw: all three assume the attack is immediate and obvious. The current one is neither.

What works now

Restrict what new accounts can do. The single highest-value change. restrictChatMember with a reduced ChatPermissions set, lifted on trust earned rather than on a clock: set can_send_photos, can_send_videos, can_send_documents, can_send_audios, can_send_video_notes, can_send_voice_notes and can_send_other_messages to false, and can_add_web_page_previews to false so posted URLs render without a preview. Note the limit: ChatPermissions has no link or forward permission, so blocking those outright means can_send_messages: false, which blocks all text too — a link-drip still needs your own message-level filter on top. A fixed 24–48 hour window is worse than useless against an attacker who waits three days; lift on time plus observed participation.

This is the defence that matches the actual attack, and it is the one most groups don't have.

Check the bio at the door. ChatJoinRequest carries an Optional bio field — present when the user has a bio and their privacy settings expose it. Farm accounts advertise in it — links, "signals", "trading", contact handles. Treat a missing bio as no signal, not as a clean one. Reading it costs legitimate users nothing.

Watch for coordination, not content. Individual messages now look fine; the pattern doesn't. Several accounts joining within a short window, from the same invite link, with similar bios or creation patterns, is a raid signature. ChatMemberUpdated carries invite_link only when the user joined through an invite link your bot can see — it is Optional, and absent for public-link joins, chat-folder joins (via_chat_folder_invite_link) and users added by an existing member. Where it is present, it plus date is enough to spot a burst; where it is absent, fall back on join timing alone.

Rate-limit first messages. Slowing a new member's first few messages costs nothing and breaks drip campaigns that depend on volume.

Trusted-member tiers. Lift restrictions on people who have been present and active for a while. Time plus participation is a far better trust signal than any challenge.

The mental shift

Stop asking "is this a bot?" at the door. You cannot reliably tell, and the answer is increasingly no — it is a human in a farm, or an AI good enough to pass.

Ask instead: "what can this account do before it has earned trust?"

That reframing makes the defence structural rather than predictive. You do not need to detect the attacker. You need an account that has been in your group for six hours to be unable to post a link to 40,000 people, whoever is behind it.

A practical baseline

  1. Join requests rather than open invite links
  2. Bio and metadata scoring at approval
  3. No media or link previews until an account has both time and activity behind it
  4. Alert on join bursts from a single invite link
  5. Lift restrictions on time plus activity
  6. Keep keyword filters, but expect them to catch only the lazy attacks

Point 3 is the one that maps to how the attack actually works. If you change nothing else, change that.

Each threat figure is attributed inline above. API capabilities verified against Telegram's Bot API documentation, September 2026.