Men Are Buying Hacking Tools to Use Against Their Wives and Friends

Thousands of men are members of Telegram groups and channels that advertise and sell hacking and surveillance services that can be used to harass friends, wives and girlfriends, and former partners, new research has uncovered. The findings, from a European nonprofit group, also say that the communities are involved in extensive trading, selling, and promotion of a huge variety of abusive content, including nonconsensual intimate images of women, so-called nudifying services, plus folders of images that sellers claim include child sexual abuse material and depictions of incest and rape.

Over six weeks earlier this year, researchers at the algorithmic auditing group AI Forensics analyzed nearly 2.8 million messages sent across 16 Italian and Spanish Telegram communities that are regularly posting abusive content targeting women and girls. More than 24,000 members of the Telegram groups and channels took part in posting 82,723 images, videos, and audio files over the course of the study, the analysis says. Many posts target celebrities and influencers, but men in the groups also frequently victimize women they know.

“We tend to forget that most victims are ordinary women who sometimes don’t even know that their pictures are shared or manipulated in these types of channels,” says Silvia Semenzin, a researcher at AI Forensics who previously exposed Italian Telegram channels engaging in similar behavior as far back as 2019. “The majority of this violence is directed towards people who the perpetrators know,” she says, suggesting that Telegram, which has over 1 billion monthly active users, according to company founder Pavel Durov, should be subject to stricter regulation and classed as a “very large online platform” under Europe’s online safety rules.

The findings come as Durov is fighting back against Russia’s efforts to block the messaging app in that country, which has long positioned itself as a messaging app that allows free speech but has simultaneously been used by some to share terrorist, sexual abuse, and cybercrime materials. Durov is under criminal investigation in France relating to alleged criminal activity taking place on Telegram, although he has consistently denied the allegations.

A Telegram spokesperson tells WIRED that the company removes “millions” of pieces of content per day using “custom AI tools” and has policies in Europe that do not allow the promotion of violence, illegal sexual content including nonconsensual imagery, and other content such as doxing and selling illegal goods and services.

Among the extensive types of abusive content and services observed by the AI Forensics researchers were frequent references to the access, publishing, and doxing of women’s private information, sharing their Instagram or TikTok content, as well as references to spying or hacking. “Victims are often named, tagged, and locatable via shared profile links,” the group’s report says.

One translated post on Telegram titled “Professional hacking on commission” claimed to be able to give customers “access to phone gallery and extraction of photos and videos,” as well as “anonymous social media hacking.” Another message says: “I hack and recover any type of social media service. I can spy on your partner's account. Send me a private message.”

Across the dataset there were more than 18,000 references to spying or spy content. One post reads: “Hi, do you have the desire to spy on a girl's gallery? We sell a bot that does it for info DM.” Meanwhile, users were observed asking if people could find phone numbers connected to Instagram accounts and other requests, “who exchanges spy photos and videos?”

Semenzin says that specific hacking tools or spyware weren’t named, and the researchers could not verify claims that any tools would work. However, multiple types of stalkerware or spyware have been used against women over the past decade. “They feel safe in offering these types of services, which deal directly with controlling your partner or stealing her personal information and personal content and selling to somebody else,” Semenzin says. “This opens up a discussion also regarding the safety of the women who become victims of this chat.”

The AI Forensics report details 13 types of abusive content seen by the researchers, ranging from “semen pictures” and the sharing of nonconsensual images, including of minors, to doxing and targeted harassment of individuals. Often, the group’s report says, access to Telegram channels would cost between €20 ($23) and €50 or have subscriptions starting at €5 per month. Dozens of abusive images were shared every hour in some Spanish-language groups, the research says, and the researchers saw some content appear in both Spanish and Italian groups. The researchers did not publish the names of the groups and declined to share the full list of channels with WIRED, although they say they reported them using Telegram’s moderation tools.

“Nonconsensual pornography including deepfake pornography is explicitly forbidden by Telegram’s terms of service and is removed whenever discovered,” a Telegram spokesperson says. Telegram’s publicly published data claim it has blocked almost 12 million groups and channels this year—including more than 153,000 groups, in excess of 1,000 per day, linked to child sexual abuse material.

“We firmly reject the idea that Telegram profits from content we are actively taking down,” the Telegram spokesperson says. “Telegram abides by EU law and all appropriate obligations set forth by the Digital Services Act and remains in constant communication with the EU Commission.”

AI Forensics researchers are not the first to document groups on Telegram or other platforms where thousands of men are sharing nonconsensual images of women or using them to direct harassment efforts. In the last year, for instance, an Italian Facebook group called Mia Moglie (“My Wife”) was shut down after men were posting images of women in their lives. Days later, a similar image-sharing website shuttered.

However, researchers have often pointed to Telegram being a key part of the wider ecosystem for abusive sharing. “Any platform or app that can be used to harm women and girls will be,” says Adam Dodge, a lawyer and founder of EndTAB (End Technology-Enabled Abuse). “Telegram stands out because it offers anonymity, speed, and large networks of like-minded users. Image-based abuse marketplaces will always emerge and thrive in these conditions, especially when they don’t just distribute nonconsensual images but also conveniently provide access to the tools and tactics to obtain them.”

In January, reports emerged from China about how people were using Telegram to share and sell intimate images of women, including in groups of up to 65,000 people. Last year, WIRED uncovered how Telegram groups were being used to “track, dox, and degrade” women who had been posting on a London-focused Facebook group called Are We Dating the Same Guy? Other Telegram groups sharing images of women have been found in Germany, Portugal, and multiple other countries over a period of multiple years.

“These networks that we found are a very small sample of a much larger phenomenon,” says Salvatore Romano, the head of research and a cofounder of AI Forensics. “We can probably say that without Telegram, it would be much harder for these people to have such a big user base.”