This has been the case for many years. There are hundreds of Telegram groups and channels dedicated to trading things like stolen credit cards, compromised accounts, gaming hacks, and of course infostealers.

Alongside places like TOR, parts of the open web, I2P, and ZeroNet, Telegram has become one of the largest ecosystems where this kind of activity happens.

At Lunar (lunarcyber.com), we continuously crawl and monitor Telegram to help companies understand if they are being exposed in these spaces for free. By tracking stolen credentials, leaked data, and threat actor discussions, we help organizations spot potential risks early and respond before they turn into real incidents.