Threat Actors Get Crafty With Emojis to Escape Detection

Cybercriminals are increasingly using emojis to evade detection and coordinate attacks across platforms like Telegram and Discord. According to threat intelligence firm Flashpoint, emojis help bad actors bypass keyword filters and communicate more effectively in multilingual environments, with symbols representing everything from stolen credentials to malware commands — like Pakistan-linked group UTA0137's "Disgomoji" malware that used camera emojis for screenshots and skull emojis to terminate processes. While emojis alone aren't decisive indicators, security teams can leverage emoji analysis to track threat actors and detect emerging campaigns, since attackers often fall into recognizable patterns when using these symbols.