For most folks, emojis are an innocent way to avoid typing, but there’s nothing innocent about the way denizens of the online underworld are using them, according to threat intelligence company Flashpoint.
As threat actor activity continues to shift toward informal, fast-moving communication platforms such as Telegram and Discord, the way adversaries communicate is evolving, Flashpoint explained in a company blog. Emojis, often dismissed as casual or nontechnical, have become a meaningful part of that evolution.
Across illicit forums, messaging apps, and closed communities, emojis are used not just for expression, but for signaling intent, categorizing activity, and, in some cases, obscuring meaning from outsiders.
“What we’re seeing across illicit communities is that emojis are being used as a consistent signaling layer alongside text,” Flashpoint’s National Security Solutions Training Director Alanah Crocker said in a statement.
“They indicate things like access, monetization, targeting, and success in a way that’s fast, repeatable, and often easier to scale across languages,” she added.
