Cybercrime is becoming more accessible as hackers ditch Dark Web for these everyday apps, experts warn
A new study has revealed the shocking truth about how cybercrime is becoming more accessible than ever before as hackers change their habits.
According to new findings from NordLayer Intelligence by NordStellar, cyber criminals are notably ditching the Dark Web in favor of an everyday app, which could make information more easily accessible for hackers.
New analysis shows that discussions of cybercrime are on the rise for messaging apps such as Telegram, with the amount increasing this year to 45%, which is up from 28% in 2025.
The research tracked seven popular cybercrime categories, including deepfakes, distributed denial-of-service, malware, phishing, ransomware-as-a-service, stealers, and malicious AI tools.
Advert
According to the cybersecurity company, each category was measured separately across both dark web forums and Telegram channels.
Cybercrime discussions are moving away from the Dark Web
Vakaris Noreika, who is a cybersecurity expert at NordLayer Intelligence, explained: “Dark web forums are essentially communities for threat actors, and they spend years building their reputation to prove the trustworthiness of their sellers.
“Each time a dark web forum gets taken down, it fragments the market. The threat actor community that used the forum then scatters across other smaller forums, where the once-trusted sellers enter as new, unverified users, and find it challenging to find new potential buyers.”
But not everyone can join these conversations, meaning that hackers could be finding it easier to talk on the likes of Telegram instead.
Noreika went on to say: “Building credibility, and even getting accepted into a new dark web forum, requires time and effort, and with the increasing likelihood of it eventually getting shut down, some threat actors might deem the investment no longer worthwhile.
“Telegram operates without these complex re-registration and reputation-building processes, making it the simpler alternative.”
The actions of cyber criminals on the messaging app violate Telegram’s terms of service but according to Noreika, that is hard to police.
He continued: “Compared with the dark web forums, Telegram presents a much lower-friction environment. Even though the platform blocked over 20 million groups and channels this year according to their official safety report, cybercriminals are quick to regroup, just as they have long done on the dark web, and doing so is far easier on Telegram.”
The expert recommends staying vigilant as the findings highlight how ‘cybercriminals are quick to adapt and are a reflection of the changes in the current cyberthreat landscape’.
Noreika urges the public to stay on ‘high alert for threats such as phishing, credential theft, account takeover attempts, denial-of-service-for-hire activity, and deepfake-enabled fraud, all of which can be scaled quickly and deployed with limited technical expertise’.
UNILAD Tech has reached out to Telegram for comment.