Threat Actors Get Crafty With Emojis to Escape Detection

Threat actors are increasingly using emojis as covert communication tools to evade keyword-based security filters and coordinate malicious activity on platforms like Telegram and Discord. Flashpoint's analysis reveals common emoji patterns tied to financial fraud, access credentials, tooling capabilities, and geographic targeting. Notable examples include the Disgomoji malware used by Pakistan-linked APT group UTA0137, which translated Discord emojis into operational C2 commands. While emojis alone aren't definitive threat indicators, their recognizable usage patterns over time offer threat hunters an additional signal layer for tracking and attributing threat actor activity across platforms.