-
The digital space records a new shift, cybercriminals have begun using emojis as a means of communicating about their cybercrimes instead of using traditional words to avoid attention.
-
They can communicate across languages by using emojis; for example, criminals working together across the globe can use general symbols like (key) to signify access credentials and (robot) to represent malware and thus work together more easily.
-
Traditional keyword filters miss these symbols entirely, the new trend is forcing analysts to update their monitoring tools and build emoji detection into their systems.
As unbelievable as it sounds, criminals also love to use emoticons (aka emoji), but instead of using them for fun, they’re now utilizing them as an alternative way of sending messages because they want to hide what they actually said and avoid attention.
Flashpoint, a threat intelligence firm, recently published a report on the use of emoticons to replace keywords within underground forum posts and dark web marketplace listings, marking a major shift in how criminals communicate with one another online.
New Communication Pattern in the Cybercrime Space
The report discussed how ‘bad’ actors are replacing sensitive words with basic visual characters (i.e., emoticons) to avoid detection by law enforcement agencies. For example, instead of writing “credit card,” they use 💳.
Instead of “bank,” they use 🏦. Instead of “password” or “login credentials,” they use 🔑. This small change helps them bypass basic keyword filters that security teams use to scan the dark web for illegal activity.
Security professionals who monitor underground forums now need to start searching for emojis too. Flashpoint warns that this creates “a layered form of obfuscation that complicates large-scale monitoring efforts.”
In simple terms, criminals make it much harder for automated systems to flag their conversations. A computer program looking for the word “malware” will miss 🤖 completely. That is exactly what the criminals want.
How Criminals Use Emojis to Communicate
Flashpoint broke down the emoji categories that criminals use into several groups. Each group serves a different purpose in their illegal communications. The company spent significant time analyzing underground forums to identify these patterns.
Criminals use 💰 and 💸 as symbols for financial activity to signify profit, successful fraud, or payments. In addition, they use a variety of other emojis when discussing cryptocurrency deals.
By doing so, criminals can have discussions about money without using the word “money.” A criminal might post a message saying “Got 💰 from 💳 fraud” instead of writing out the full sentence.
For access credentials and compromise, emojis like 🔑 and 🔓 relate to stolen passwords and account access. They also use these symbols to indicate successful breaches or unlocked accounts.
A hacker might post 🔑 for sale, meaning they have login credentials for a specific company, another might use 🔓 to brag about breaking into a secure system.
When discussing software and services, cybercriminals use the emojis of 🤖, ⚙️, and 🧰 to describe the types of software or tools used for hacking, system settings, and toolkits, or bundled services, respectively.
For instance, the use of 🤖 emoji indicates the sale of an automated hacking program, the ⚙️ emoji often indicates settings or configuration files that come with the malware package.
Other categories include targets and geography, plus urgency, success, and status. For example, criminals use 🚀 to indicate a fast or successful attack.
They use ⏰ to signal time-sensitive deals. The full list of analyzed emojis is available on Flashpoint’s website for security professionals who want to update their monitoring systems.
Why Emojis Work So Well for Criminals
There is another practical reason criminals love emojis. Not everyone in the cybercriminal community speaks perfect English, many threat actors come from non-English speaking countries like Russia, China, Brazil, and Vietnam. Emojis help them communicate quickly across different languages and regions.
A criminal in Russia and a criminal in Brazil might not share a common language. But both understand that 💳 means credit card and 🏦 means bank.
Both know that 🤖 means malware or automated tools. This universal understanding makes emojis a perfect tool for global crime rings. They eliminate language barriers instantly.
Emojis also help criminals evade automated detection systems. Most security tools scan for specific keywords like “credit card,” “malware,” or “stolen passwords” ; these tools do not typically scan for emojis.
A criminal can write a complete conversation about stolen credit cards using only symbols, and traditional filters will miss it entirely. Flashpoint describes this as “a layered form of obfuscation” that makes monitoring much harder.
This trend forces security companies to update their monitoring systems. Flashpoint’s report serves as a warning to the cybersecurity industry. Analysts can no longer ignore the smiling faces, keys, and money bags appearing on underground forums. They must now build emoji detection into their scanning tools.
The best defense now includes emoji detection alongside keyword scanning. Security teams must think like criminals and anticipate their next move. Otherwise, illegal conversations will continue hiding in plain sight, the perpetrators disguise them as harmless symbols that billions of people use every day.
