Deepfake pornography is becoming increasingly easy to create through specialized Telegram bots that allow users to manipulate other people’s photos with little to no technical expertise. Some of these services also encourage users to keep coming back by offering credits, referral bonuses, lotteries, and other rewards.
Senior Centre for Information Resilience (CIR) researcher Tom Jarvis uncovered a network of bots operating on Telegram that are designed to create deepfake sexual content.
These bots feature “deliberately simple” menus that make the process as easy as possible. Users can upload photos taken from the internet or social media platforms such as Instagram, after which the service uses AI to generate fake nude images of the person.
The bot has no way of determining whether the person shown in the photo has consented to such manipulation. Nothing prevents a user from uploading an image of a classmate, a stranger, or a public figure.
Manipulating other people’s photos existed long before the rise of generative AI. In the past, tools such as Photoshop and other image editors were commonly used for this purpose. However, according to Jarvis, today’s services make it possible to produce fake sexual content at scale “with minimal technical skills.”
The services examined by CIR also indicate that women and children are among the primary targets of this type of content. Most promotional materials for the bots feature female-presenting figures in various poses and at different stages of simulated undressing.
Some services also offer dedicated “studio” modes. These allow users not only to generate fake nude images but also to digitally alter a person’s clothing, including dressing them in fetish outfits such as black latex.
Deepfake sexual content does not always remain private after it is generated. Some services provide shared libraries where users can publish their creations and display them to others.
As a result, victims can be harmed repeatedly. Fake intimate images may be viewed by other users, copied, rated, shared, and forwarded, including as a way of demonstrating what a particular bot is capable of producing.
In some cases, CIR found that users could receive rewards for popular deepfake pornographic content. If an image performed particularly well, its creator could receive additional tokens.
The services also encourage users to return through referral bonuses, lotteries, and extra credits. In this way, operators seek not only to attract new users but also to keep existing ones engaged.
In one of the services examined, generating a single image costs one credit, while a video costs five credits. New users receive six free credits, with the expectation that they will eventually continue using the service by paying for additional access.
Basic or less explicit modes are often available for free, while premium features and more explicit content require payment.
Payments can be made using cryptocurrencies or Telegram Stars. As Telegram notes, users do not need to provide bots with personal information or bank card details to make payments with Stars.
Researchers also highlighted another important aspect of the system. Simply blocking Telegram bots is not enough because the bot itself is often only the visible front end of a much larger infrastructure.
Bots can redirect users to separate domains where the core services actually operate. Payment systems, backend code, and image or video generation infrastructure may be hosted on external web services or run through third-party APIs.
This effectively makes the visible Telegram bot a disposable point of entry. Even if a bot is blocked, the backend, payment infrastructure, referral system, and other components can continue operating independently.
As a result, removing individual bots does little to disrupt the underlying infrastructure. Operators can create a new access point to replace a blocked bot without having to rebuild the entire system from scratch.
Fake intimate images existed before the rise of generative AI, but the technology has significantly lowered the technical barrier to creating them. Tasks that once required experience with image-editing software can now be partially automated by specialized services.
In this setup, Telegram may serve primarily as a convenient interface connecting users to external infrastructure. This means that taking down individual bots does not necessarily shut down the services behind them.
According to the researchers, effectively combating these platforms requires targeting not only Telegram bots but also the domains and server infrastructure that keep them running. They also argue that Telegram should strengthen preventive measures and explicitly recognize AI-powered sexual image manipulation as a form of abuse.
