Telegram, which prides itself on being a privacy-focused messaging app, has been embroiled in controversy due to a weakness in its handling of certain proxy links that can expose users' IP addresses with a single click. Several cybersecurity researchers have demonstrated that simply opening a manipulated internal link is enough to cause a device to establish an unwanted connection with an external server.
The problem lies not so much in the proxy technology itself as in how it's being exploited. Malicious actors are disguising special proxy-type links under seemingly harmless t.me domains , so that the user believes they are simply opening a username or internal link, when in reality they are exposing sensitive connection data that can be collected by third parties.
How proxy links work on Telegram and why they are used
Telegram uses links like t.me/proxy?… to quickly configure MTProto proxies in the platform's official clients. These special URLs allow users to add a proxy server with a single tap, without manually entering the server address, port, or secret key. To learn more about how the platform works, see our Telegram guide.
This system is designed to facilitate access to Telegram in contexts where there are internet blocks or censorship . Proxies allow users to bypass geographical restrictions and partially conceal their real location , something highly valued by activists, journalists, groups in countries with heavy surveillance, and, in general, by those seeking greater anonymity online.
Typically, these proxy links are shared explicitly, clearly stating that the URL is intended to configure an intermediary server. When the feature is used legitimately, the user knows they are adding a proxy and can decide whether connecting to that specific server is worthwhile to better protect their communication.
However, the same feature that facilitates the use of proxies is now being exploited against the user. Researchers have detected that criminals are disguising these links as simple usernames or normal internal Telegram links , so they don't raise suspicion and the click occurs almost automatically.
According to the tech website Bleeping Computer, the key to the problem lies in the fact that the Telegram client on Android and iOS performs an automatic test connection when one of these proxy links is opened . This test connection is launched even before the user confirms whether or not they want to add the proxy to their settings, which opens the door to IP address leaks.
What risk is there in having the IP address leaked?
An IP address is a piece of technical data that, at first glance, may seem harmless, but in the wrong hands, it reveals a great deal of information. By forcing a direct connection from a mobile device to a remote server, attackers can record the user's real IP address , even if the user believes they are protected by other layers of privacy.
With that IP address, a malicious actor can estimate the user's approximate location , in many cases with enough accuracy to pinpoint a specific city or region. This, combined with other data, allows for the creation of activity profiles, connection times, and behavioral patterns that can be exploited for commercial purposes, surveillance, or even harassment.
Furthermore, exposing the real IP address opens the door to targeted attacks against the victim's device or network . Depending on the router and hardware configuration, an attacker could attempt to scan ports, exploit vulnerabilities, or launch distributed denial-of-service (DDoS) attacks against a specific individual.
The researchers who analyzed this abuse point out that, in many cases, those affected thought they were simply interacting with a standard Telegram link , unaware that they were triggering a connection to an external server controlled by a third party. This information asymmetry is precisely what makes the finding so concerning from a privacy perspective.
The covert use of these links can also be used to generate detailed profiles of European or Spanish users participating in public channels, thematic groups, or sensitive communities. If an attacker manages to trick members of a specific group into clicking on a manipulated link, they can end up with a list of IP addresses associated with that group, with the implications this could have in political or activist contexts.
Who discovered the problem and how was it verified?
The first public alert about this abuse came from the Telegram channel chekist42 , which demonstrated how it was possible to exploit the way the client handles proxy links to log IPs without explicit consent. From there, the finding was verified by various cybersecurity specialists , including the researchers known as GangExposed R and 0x6rss.
The website Bleeping Computer reported on and expanded upon the investigation, confirming that the issue affected both the Android and iOS versions of Telegram . In both systems, the proxy connection testing mechanism functions similarly, leaving millions of users in Europe and around the world vulnerable.
Coverage of this vulnerability has not been limited to the technical sphere; European news agencies and media outlets have also picked up the story , highlighting the potential impact on user privacy in the region. For an application so popular in Spain and other EU countries, the fact that IP addresses can be leaked without clear warning is considered particularly concerning.
Telegram has thus found itself in the spotlight, as the app is routinely promoted as a secure alternative to other messaging platforms. The revelation that a simple disguised link can expose a user's real IP address clashes with the image of enhanced privacy that the company has cultivated in recent years.
In this context, various cybersecurity experts have emphasized that this is not a massive automated attack, but rather a targeted technique that requires the user to click on a specifically designed link. Even so, the potential for abuse makes the issue highly relevant for anyone who uses Telegram on a daily basis.
Telegram's official response and a comparison with other apps
In response to inquiries from media outlets such as Bleeping Computer, Telegram has acknowledged the problem and pledged to implement changes to reduce the risk of IP exposure through these proxy links. A company spokesperson stated that they will "include warnings on proxy links" so that users are aware of what is happening when they interact with them.
According to the announcement, the idea is that when one of these links is clicked, the application will display a message clearly informing the user that it will attempt to connect through a proxy and that this action may reveal their IP address to the destination server. This extra step would help curb abuse, as the user could cancel the operation if they suspect something is amiss.
However, Telegram has not yet provided a specific date for the implementation of these warnings , nor has it detailed whether it will introduce additional changes to how automatic connection tests are performed. This lack of a timeline has generated some concern among users more worried about their privacy, especially in Europe, where data protection regulations are stricter.
The company also pointed out that IP exposure when connecting to a remote server is not a problem unique to Telegram . In practice, any service that requests the device to open a direct connection to a third-party server can see and record that address; this even happens on other messaging platforms like X Chat.
While this is true, experts point out that, in this case, the peculiarity lies in the fact that the connection occurs in the background as part of an automated test , and not as a clear consequence of a conscious user action. Therefore, they insist that it is important to strengthen transparency and give users more control over when and how these types of connections are established.
How can users protect themselves in Spain and Europe?
While Telegram adjusts its behavior, users can take several steps to reduce risk. The first and most basic is to exercise extreme caution when clicking on links received through chats, channels, or groups , especially if they come from unknown sources or accounts that have just appeared in a conversation.
It's important to carefully examine the URL structure before opening it. Although attackers may try to disguise it, legitimate proxy links usually follow the pattern t.me/proxy?… with additional parameters . If anything in the link seems strange, excessively long, or is associated with a user or channel that doesn't inspire confidence, it's best to leave it alone and, if in doubt, ask the sender.
Another recommendation for those particularly concerned about privacy, including their IP address, is to use a trusted VPN or connect through a network that doesn't directly reveal their home connection . This way, even if a test connection to the proxy occurs, the IP address seen by the remote server will be that of the VPN or intermediary network, not the end user's.
In the European context, where there is increasing sensitivity towards data protection, it is also advisable to periodically review Telegram's privacy settings and limit the exposure of other personal data, such as profile picture or account information, only to trusted contacts.
For advanced users and cybersecurity professionals, monitoring the device's network traffic when a link is suspected can be helpful in order to verify which addresses the application is actually connecting to. This allows for the detection of unusual behavior and better documentation of potential abuse.
The Telegram proxy link scandal serves as a reminder that even privacy-focused apps can have vulnerabilities if certain features aren't clearly communicated or are overly automated. A combination of independent research, company response, and more vigilant users will be key to minimizing the impact of such incidents on daily digital life.
