# maltego-telegram: pulling Telegram channels into a Maltego graph > Maltego Telegram is a set of Maltego Transforms that bring Telegram data into a Maltego graph, so an investigator can work on channels, groups and users as entities with links rather than as a list of search results. It suits an OSINT practitioner who already lives in Maltego and wants Telegram evidence in the same graph as everything else, and the cost is a Python toolchain, Telegram API credentials and a login step before any of it works. **vognik/maltego-telegram** — 🔎 OSINT Maltego Transforms for investigating Telegram channels, groups, and users, including deanonymization via stickers, forwarded messages, similar channels, deleted posts, and more. - Repository: https://github.com/vognik/maltego-telegram - Stars: 574 · Forks: 68 - Language: Python - License: GPL-3.0 - Published: 2026-10-22 · Updated: 2026-10-22 · Language: en - Canonical page: https://hysenlabs.com/projects/vognik-maltego-telegram ## Transforms, not a Telegram client Maltego Telegram is an OSINT utility that enables investigations on Telegram through a collection of Maltego Transforms. It brings Telegram data into Maltego, helping investigators explore connections and visualize relationships, and the project says it is built for one thing, Telegram investigations, and makes them simple and intuitive. The choice of delivery mechanism is the whole design. A Maltego Transform is a small program that operates on entities in the graph, and the value of running Telegram queries as Transforms rather than as a separate tool is that the results arrive as entities and links, in the same place as the rest of a case, rather than as a spreadsheet you have to correlate by hand. The repository layout is what you would expect for a Maltego add-on. There is a `transforms/` directory holding the Transform implementations, an `adapters/` directory for the Maltego API glue, and `client.py`, `extensions.py`, `settings.py` and `utils.py` at the root for the Telegram client, custom entity extensions, configuration and shared helpers. `login.py` handles authentication and `project.py` generates the files Maltego imports, and there are `tests/` and a `static/` directory for the images used in the documentation. Two generated artefacts sit at the root as well, `entities.mtz` and `telegram.mtz`. Those are the files you import into Maltego, and the fact that they are committed rather than generated on demand means the project ships a working import before you have configured anything. The stack is Python with the `maltego-trx` package for writing Transforms, and the Telegram side uses `Kurigram`, which the requirements list at 2.2.26, along with `py-tgcalls` and `ntgcalls` for the call handling, `flask` and `werkzeug` for the local HTTP surface that the Transform runtime talks to, and `jinja2`, `pillow`, `requests` and `cryptography` for the surrounding work. The project is GPL-3.0 licensed, the last push was on 2026-10-19, and there are no GitHub releases. ## Four ways to link a channel to the person behind it The feature set is the substance of the tool, and the four documented capabilities are all about finding a link between an anonymous channel and an account. Sticker and custom emoji packs can provide another way to identify their creators. The tool can identify the account associated with a pack's creation, resolve the creator's profile when it is accessible, and map the connection between the pack and its creator in Maltego. The stated significance is that a creator's account can provide a link between otherwise unrelated packs, which is the deanonymisation step: one person publishing several packs across several channels is a join you would otherwise never make. Similar channels use Telegram's own recommendation mechanism. Telegram displays related channels as a list, and mapping these recommendations in Maltego makes their connections easier to explore. The tool retrieves channel recommendations through the Telegram API, displays channels as entities connected by recommendation links, and expands the graph to identify groups of related channels. Expanding recommendations from multiple channels to find shared connections is the technique here, because one channel's recommendation list and another's can intersect, and the intersection is a cluster. Profiles linked to a channel come from forwarded messages. Forwarded messages may contain references to their original authors, and these can reveal personal profiles associated with a channel. The tool inspects forwarding metadata for references to user accounts, resolves accessible author profiles, and connects those profiles to the channel. The note that older forwards may retain author links after privacy settings change is the interesting detail, because it means the historical record can carry a link that the current settings no longer show. Deleted posts and archived content use the numbering. Telegram assigns sequential numeric IDs to channel messages, and gaps in the sequence can help locate potentially deleted posts. The tool detects missing IDs in a channel's message history and checks public Telegram archives for matching channel and post IDs. Archived copies may include the original text, media and publication date. The archived content case is the one where the answer is still recoverable. A deleted post is not gone, it has a number, and the number is a key into the public archives. ## The install is a login and two imports The installation sequence is short and it has one part that is not obvious from a package listing. First, clone the repository: ```bash git clone https://github.com/vognik/maltego-telegram cd maltego-telegram ``` Then install the dependencies: ```bash pip install -r requirements.txt ``` Then configure Telegram API credentials. You obtain your `api_id` and `api_hash` from Telegram and add them to `config.ini`. This is the standard Telegram API application registration, and it is worth noting that it is a separate thing from a user account: the api_id and api_hash identify your client application, while the next step authenticates the account itself. Log in to Telegram: ```bash python login.py ``` and follow the prompts to authenticate your Telegram account. Then generate the Maltego Transform files: ```bash python project.py ``` Finally, import them into Maltego. In Maltego, open Import Config and import both generated files, `entities.mtz` and `telegram.mtz`. The order matters and the reason is visible in the sequence. The Transforms run server-side from Maltego and need to reach Telegram, and they do that through your logged-in session, so the session has to exist before the Transforms are generated and imported. A first run in the wrong order gives you a Transform that connects and then cannot authenticate, which is a confusing symptom for what is really a missing login step. The pinned requirements are worth a look if you hit a conflict. The list is fully pinned, with `maltego-trx` at 1.7.0, `Kurigram` at 2.2.26, `flask` at 3.1.3, `pillow` at 12.3.0 and `requests` at 2.34.2 among the others, and the presence of `py-tgcalls` and `ntgcalls` is a reminder that the tool reaches into parts of the Telegram client protocol that go beyond plain messaging. ## Running a Transform is three actions in the Maltego UI The usage section is three steps, all of them inside Maltego. You drag an entity from the Entity Palette onto the graph. You right-click the entity to view the available Transforms. You select a Transform to run it. There is no command line interface of its own in the documentation, and that is not an omission so much as the point. The tool is an extension of Maltego, so the interface for running a query is the Maltego graph, and the interface for a result is an entity or a link on that graph. An investigator working in Maltego does not learn a second tool to ask a question about a channel. The dependency on a local HTTP surface is implied by the `flask` and `werkzeug` entries in the requirements and by the `maltego-trx` package itself, which is the framework Maltego provides for writing Transforms in Python. The Transform process and the Telegram session have to live in the same Python environment, because the Transform is the thing making the Telegram calls. The `config.ini` file is therefore doing more than holding two values. It is the place where the Telegram application identity and, in practice, the path to the session live, and it is the file to look at first when a Transform connects but returns nothing. One point on scope, taken from the project itself. The README says it is built for the OSINT community, that contributions, ideas and feedback are welcome, and to use it responsibly and only for lawful investigations. That matters here, because the features are deanonymisation features by design, and a tool that resolves the account behind a channel should be in the hands of people with a legitimate reason to ask. ## What the transforms can and cannot see, and the alternative of doing it by hand The honest limits of this tool follow from the fact that it queries Telegram as your account rather than as a service. Every Transform runs with your session, so what you can resolve is bounded by what your account can see. If a channel is private, a profile is set to hide its forwards, or a sticker pack belongs to a user who has since deleted the account, the corresponding Transform has nothing to work with. The project is careful about one case in particular, noting that older forwards may retain author links after privacy settings change, which is a reminder that the historical record is not always aligned with the current setting, in either direction. There is also a rate limit consideration that the documentation does not spell out. Each query is a call to the Telegram API made on behalf of a real account, and the recursive parts of the design, expanding recommendations from multiple channels to find shared connections, multiply that. An investigator running a broad sweep across many channels is making many requests as one user, and the tool does not document how it behaves at the edges of what an account can do in a short window. The alternative approach is to collect the evidence yourself, outside Maltego, and enter the entities by hand. For a single channel with a handful of forwards, that is quicker than installing a Python toolchain and importing two files. The tool earns its setup cost when the work is a graph, when you want the recommendation links resolved rather than read one at a time, and when the output has to be shared as a case file with the links intact. What the tool cannot do is replace the judgement. Every link it draws is a hypothesis, a shared sticker pack, a mutual recommendation, a forward from a profile, a gap in a numbering sequence. Each needs a human to decide whether it means what it appears to mean, and the Maltego graph is where that judgement is recorded alongside everything else in the investigation. ## Conclusion Adopt maltego-telegram if your OSINT work already happens in Maltego and you need Telegram entities and links in the same graph as the rest of your case. Do not adopt it as a standalone Telegram client, since every query is a Transform that has to be imported into Maltego first, and check first that your Telegram credentials have the API access these queries need, because the tool authenticates with your own account and its visibility is bounded by what that account can see. ## FAQ ### What is Maltego Telegram? It is an OSINT utility that enables investigations on Telegram through a collection of Maltego Transforms, bringing Telegram data into Maltego so investigators can explore connections and visualise relationships. It is written in Python, licensed GPL-3.0, and the last push was on 2026-10-19. ### How do I install maltego-telegram? Clone the repository, run `pip install -r requirements.txt`, put your Telegram `api_id` and `api_hash` in config.ini, authenticate with `python login.py`, generate the Maltego files with `python project.py`, and then import entities.mtz and telegram.mtz into Maltego through Import Config. ### What can the Maltego Telegram transforms find out about a channel? They can identify the account behind a sticker or custom emoji pack, map the related channels Telegram recommends, and resolve profiles linked to the channel through forwarded messages, with older forwards retaining author links after privacy settings change. They can also detect gaps in a channel's message IDs and check public Telegram archives for matching posts that were deleted. ### Why do I need to log in to Telegram before importing into Maltego? The Transforms reach Telegram through your own logged-in session, so the session has to exist before the Transform files are generated and imported. The requirements also include flask and werkzeug for the local HTTP surface the Transform runtime talks to, and maltego-trx for writing the Transforms themselves. ### What Python libraries does maltego-telegram depend on? The requirements are fully pinned, with maltego-trx at 1.7.0, Kurigram at 2.2.26 for the Telegram client, py-tgcalls and ntgcalls for call handling, flask at 3.1.3, werkzeug, jinja2, pillow, requests and cryptography among the others. The repository also contains a transforms directory, an adapters directory and a tests directory. ### Is maltego-telegram still being developed? The repository is not archived and the last push was on 2026-10-19, though there are no GitHub releases. The README asks for contributions and says to use it responsibly and only for lawful investigations, and the homepage for the project is a GitHub repository with the full collection of Transforms. ## Sources - [Issues](https://github.com/vognik/maltego-telegram/issues) - [License: GPL-3.0](https://github.com/vognik/maltego-telegram/blob/main/LICENSE) - [README](https://github.com/vognik/maltego-telegram/blob/main/README.md) - [vognik/maltego-telegram on GitHub](https://github.com/vognik/maltego-telegram) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/vognik-maltego-telegram