- Flashpoint warns that cybercriminals are using emojis to avoid detection
- Emojis replace fraud and financial keywords to bypass filters
- Symbols like 💳, 🔑, 🤖 signal cards, credentials and malware
Just like everyone else these days, cybercriminals also use emojis. But they don’t just use them to make their messages fun or exciting, they also use them to hide their communications in plain sight and avoid the scrutiny of security analysts.
This is according to a new report from threat intelligence experts, Flashpoint. Released earlier this week, Flashpoint says threat actors can replace emojis with keywords associated with fraud techniques, financial activity, and specific platforms or services.
“For example, replacing ‘credit card’ with 💳 or ‘bank’ with 🏦 can help bypass basic keyword filters or reduce visibility in automated moderation systems,” the report said. “When combined with slang, abbreviations and multilingual phrasing, this creates a layered form of obfuscation that complicates large-scale surveillance efforts.”
The article continues below
In other words, security professionals scouring the dark web for news of breaches and new malware services should also start adding emojis to the list of monitored keywords.
Numerous categories
Flashpoint has divided the emojis villains use into a few categories, such as financial activity, access information and compromise, tools, automations and services, targets and geography, and urgency, success and status.
Some emojis, such as 💰 and 💸 can signal profits, successful scams or payouts, while 🪙 can suggest cryptocurrency-related activity.
These emojis – 🔑 or 🔓, relate to credentials and account access, as well as successful breaches and unlocked accounts. For tools, automation, and services, emojis like 🤖, ⚙️, or 🧰 describe malware, settings, toolkits, and bundled services.
The full list of analyzed emojis can be found here.
Flashpoint also says that there is another practical side to using emojis, and that is – being able to communicate properly across regions and languages. Not everyone in the cybercriminal community speaks (correct) English, and it certainly helps to inform everyone of certain activities – quickly.
The only thing we add to it is – 🤮
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews and opinions in your feeds. Be sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, video unboxings, and get regular updates from us on WhatsApp also.
