Emojis are bright and colorful and can be used to represent emotions, humour, and communicate easily. They can be found everywhere- in our email, on social media, in our messaging apps, and in our corporate communications. However, despite their fun look, cybercriminals are now increasingly weaponizing emojis.
Although using emojis by hackers may seem trivial and insignificant, it may be a large step forward in the evolution of techniques used by cybercriminals. As organizations improve their traditional approaches to preventing malware, phishing, and data breaches, attackers create new and more creative approaches to attack. The universal appeal of emojis and their minimal suspicions provide a great opportunity for attackers to avoid detection systems and manipulate individuals.
The purpose of this article is to discuss how hackers can use emojis in a cyber attack, examine why they are a successful tool for hackers, and provide examples of how both organizations and individuals can mitigate the risks of these types of attacks.
The Evolution of Social Engineering
Cybersecurity threats have changed dramatically over the last 10 years. Many of the early attacks relied heavily on technical exploits (e.g., malware, vulnerabilities, and brute force). However, a significant amount of successful attacks that are occurring today rely on social engineering, where the human aspect is the victim and target of the attack. Attackers have come to understand that sometimes it is much easier to deceive a person than it is to breach a computer system.
Phishing emails, fake messages, and impersonation attacks have become some of the most common methods for cyber criminals to gain access to systems. These types of attacks are successful because they rely upon exploiting the target’s trust, urgency, and familiarity.
Adding an emoji enhances each of the three elements. Attackers add an emoji to make their message appear:
- Friendly and/ or legitimate
- Evokes emotion and influences an individual’s decision-making process
- Reduces the target’s suspicion by mirroring normal patterns of communication.
As more and more informal messaging becomes the mode of communication used at work- especially via apps like Slack and Microsoft Teams– the use of emojis is seamlessly blended into legitimate communications.
How Hackers Use Emojis?
The use of emojis in cybercrime is actually a collection or group of techniques that are constantly evolving from both a technical manipulation and/ or psychological deception perspective.
Emojiphishing
One of the most common ways in which cyber criminals use emojis is through phishing campaigns. Phishing emails have a tendency to trigger spam filters due to their recognizable content, such as suspicious links, use of urgent language, and known bad signatures. The use of emojis allows cyber criminals who create phishing emails to circumvent most spam filters by rearranging the original format of the email.
Some forms of visual support include:
- Green check mark emoji for verification
- Warning signs to create a sense of urgency
- Padlock signs to indicate security or legitimacy
Secondly, the use of imagery provides a method that can elude text-based detection by some filtering processes that depend on keyword recognition. The insertion of imagery between the written word creates a disruption in the pattern recognition by some.
Emoji Distortion Used in URLs and Payloads
Aside from social engineering, emojis are being used in other ways, such as distortion techniques. The use of encoding, known as Unicode encoding, is used to embed emoji into a URL and/ or domain name using homograph attacks to distribute domain names similar to legitimate domain names.
An illustrative example of this process may occur when using an emoji or character that looks similar to the actual character in a domain name, thereby impairing the user’s ability to distinguish between actual and illegitimate websites.
Additionally, other methods such as emoji use in:
- Redefining malware scripts
- Hiding payloads within ostensibly innocuous content
- Bypassing signature-based detection
Since many security technologies are not entirely configured to analyze encoding based on emojis, such techniques may escape detection.
Use of Emojis as Command-and-Control (C2) Communication
An example of a more advanced use of emojis is within C2 (Command-and-Control) systems. When there are advanced attacks with malware, the malware must communicate with the remote server to receive commands or send information back. Historically, this communication was easily monitored and flagged by security systems.
But, more recently, attackers are using emojis to embed commands inside emoji sequences.
For example:
- The different emojis can represent specific commands (e.g., the image of a chef’s hat could be a command for the malware to download a certain file).
- The different emojis can also be used to provide data or instructions as an encoded sequence.
- These messages can be sent through public platforms (e.g., social media), which helps blend into the normal traffic, thus making it difficult for security tools to identify the malicious communication since it looks just like normal user behavior.
Insider Threats and Covert Communication Using Emojis
Emojis can also play a role in insider threats and covert communications between employees or an employee who has had their account compromised; specifically, employees could use emojis to:
- Signal signal actions or intentions
- Send encoded information to each other
- Avoid any keyword-based monitoring by using emojis.
Since most security systems typically ignore the use of emojis, they serve as a lower visibility channel for sensitive communications and allow attackers to communicate without being detected.
Utilizing Messaging Platforms for Malware Delivery
The new way of working for most organizations is to rely on messaging platforms such as Slack, Teams, or Zoom, using Microsoft Office products/365 for instant messaging. Therefore, attackers will utilize this capability to include malicious links/attachments via emojis within a message, for example: ‘Here is the report 😀.’
Why Emojis Are Effective Tools in Cyber Attacks
The success of emoji-based cyber attacks can be attributed to both psychological and technical components.
Psychological Trust Signals: We respond to visual cues. Emojis convey emotion and facial expressions, which create instant reactions.
A friendly emoji in a text can evoke trust and confidence in the message. A warning emoji can create a sense of urgency. This visual information will guide the user’s understanding of the text and usually bypasses critical thinking.
Normalisation of Digital Communication: Emojis are now a normalized form of communication. People of all ages and in every profession use them.
This normalization of emojis means:
- There is no suspicion that they would raise
- They can blend in with other legitimate forms of messaging
- They are not usually rated/checked for incorrect use
Because of the normalization, the attacker’s ability to utilize emojis to execute attacks is enhanced, and their use continues to increase.
Limitations of Security Tools: Most cybersecurity tools are built to analyze text and are therefore designed to analyze visual symbols.
The challenges faced in the analysis of emojis include:
- Unicode character inconsistencies may arise
- The emoji encoding itself is difficult to parse
- No industry standard specifications exist for detection rules
As a result, emojis can create a blind spot in security infrastructure against cyber attacks.
Cross-Platform Compatibility: Emojis are compliant across all operating systems, applications, and devices.
This compatibility allows the attacker to:
- Reach their message across a variety of people
- Ensure a cohesive look to their message throughout each platform
- Avoid compatibility issues that would expose their methodologies.
Real-World Examples and Emerging Trends
As emoji attacks continue evolving, several trends have been observed in the real world. Security researchers have found that phishing campaigns use emojis to increase click rates. Phishing emails with emojis in the subject line often have significantly higher engagement than those without an emoji in the subject line. Also observed were:
- Malicious domains using Unicode characters that look similar to emojis
- Messaging attacks that use slang and pictures
- New experimental malware that uses non-traditional ways of sending data
All this shows that cybercriminals continuously evolve with human behavior and technology gaps.
Role of AI in Amplifying Emoji-based Attacks
With the continued advancement of AI technology, the evolution of how threatening emoji-based attacks using AI will become much more advanced.
AI technology can:
- Collect highly tailored phishing message content
- Analyze individual communication patterns to replicate how that individual behaves when communicating
- Find the best way to use emojis to create the highest response rate from an individual using an emoji
As an example, AI will know which specific emojis will provide the best chance for a response given the target’s details, thereby making the attack more focused and believable. The use of AI and social engineering together has significantly increased the available threat capability.
Detection Challenges and Security Gaps
To effectively defend against emoji-based attacks, organizations need to rethink traditional approaches to mitigating threats. For example, signature-based detection is often insufficient due to the following reasons:
Evading detection using emojis has a very broad scope of uses (there are numerous emoji misuses), complex encoding methods, and complicated patterns that are difficult to apply consistently. A behavioral analysis approach can therefore be better used to detect evasion, and can be used to:
- Identify unusual communication patterns;
- Identify behaviors that show an anomaly.
- Conduct context-based analysis for the type of communications (e.g., messages) sent and received.
However, the development of Systems that can use these types of analytical methodologies will require high-level tools and capabilities.
Mitigation Strategies
Reducing the risks associated with deploying emoji-based attack vectors requires a combination of technology, policy, and user awareness.
Enhanced Security Tools
Businesses must implement security solutions capable of:
- Reviewing Unicode and non-standard characters;
- Identifying the combination of emojis in their messages (to ‘Obfuscate’ messages);
- Monitoring formats of communication channels (non-standard), including social media (Facebook, Twitter, instagram, etc.) for use of emojis in communications.
Next-generation threat detection systems that leverage machine learning and are constructed to leverage AI algorithms are also able to provide further enhancements to organizations’ ability to understand the scope of these types of attacks.
Employee Awareness/Training
Human behaviour continues to remain the weakest link in cybersecurity. Employees must receive training on:
- The dangers of informal ways of communicating.
- The use of emojis in phishing-type attacks.
- The need to verify messages prior to responding.
Awareness is an important element that reduces the effectiveness of social engineering techniques.
Zero Trust Architecture
The implementation of a zero-trust architecture provides assurance that:
- No communication will be implicitly trusted.
- All communications will be validated.
- All access to communications will be continuously audited.
This type of architecture will continue to reduce the effect of using compromised accounts/actors as well as the extent of deception with falsified (using emoji) communications.
Policies and Governance
Organizations should create and publish formal policies around:
- Communication practices;
- Acceptable use of platforms used to communicate.
- How to handle sensitive information.
Policies such as these create an organized and safe way of communicating.
Future of Cyber Threats Based on Using Emojis
With digital communication rapidly improving, we can anticipate more advanced types of cyber threats that utilize emojis.
Future developments may consist of:
- Advanced encoding techniques using symbols and images
- Integrating deep fake and AI-generated content
- More designers are using multiple channels for their attacks
There will be an ongoing blurring of the lines between legitimate and fraudulent types of interactions.
Conclusion
Fear and anxiety of, and from, using an emoji are small concerns leading to a major area of concern: as we advance in technology, so too must we advance our knowledge of humanity, as cyber criminals exploit the tiniest aspect of a human’s method of communication in order to manipulate.
By far, one of the largest benefits to an emoji, from a cyber criminal’s point of view, is the trust, comfort, and emotion an individual has associated with it. Thus, an emoji may not cause an employee to pause and consider whether the interaction is fraudulent.
The increasing number of cyber crimes committed with emojis demonstrates the continued need for organizations and individuals to adapt their intelligence and predict their risks by addressing the psychological aspects of cybercrime.
Finally, the dilemma isn’t with the emoji or even the fact that it’s used: it’s with how the individual uses that emoji. Only in the hands of an unscrupulous person will the smallest item become a significant weapon.
