Telegram Accounts Are Being Stolen More Often and Cost Less. What Happened to the Shadow Market?
1.5 million accounts stolen in just half a year.
The company F6 has published a study on the growth of Telegram account hijackings. According to analysts, in the first half of 2025, the number of account thefts increased by 51% compared to the same period in 2024 and by 20% compared to the second half of 2024.
Just one Russian-speaking hacker group stole 1.49 million accounts from January to June. On average, over 8,000 accounts were hijacked daily. At the time of the study, F6 specialists had identified at least four such groups.
On shadow markets, hijacked accounts registered to Russian numbers were sold for an average of 128 rubles, which is 20% cheaper than in the second half of 2024. The price depends on the "aging" period (the time between the theft and the owner's recovery of the account) and the number of available offers. The lowest cost was for Indian accounts—starting from 12 rubles.
There is also demand for foreign accounts. Accounts from the USA, Canada, Great Britain, Italy, Romania, as well as African countries and Southeast Asia are actively traded.
The methods used by the criminals remain the same: phishing link campaigns. Examples include messages about fake votes, gift subscriptions to Telegram Premium, and warnings from "security services." In April, F6 analysts recorded a new scenario: phishing sites masqueraded as Easter greetings allegedly from the head of a municipal district.
F6 specialists note that noticeable changes have occurred in the Telegram account hijacking sphere in 2025. The first is that the number of thefts of Russian users' accounts continued to grow from January to March, but then began to gradually decline. In June, the number of stolen accounts was half that of April. The second is that in late June, some trading platforms popular among cybercriminals banned the sale of Russian accounts on their resources. Fraud groups specializing in stealing accounts from Russia were faced with a choice: find new sales channels or switch to foreign accounts.
Analysts emphasize that the ban on selling Russian accounts on some darknet platforms did indeed reduce market volumes and pushed out some groups. However, this does not mean the threat has diminished: schemes are constantly changing, and criminals are finding new ways to circumvent measures.
