According to threat intelligence company Flashpoint, emojis are used not just for expression. They are also used for signaling intent, categorizing activity, and, in some cases, obscuring meaning from outsiders.

Flashpoint’s National Security Solutions Training Director, Alanah Crocker, said in a statement that this has been seen across all illicit communities, where emojis are used as a consistent signaling layer alongside text. According to her, they indicate things like access, monetization, targeting, as well as success making communication fast, repeatable, and often easier to scale across languages.

Platforms like Telegram and Discord are providing threat actors with encrypted high-velocity, ephemeral channels. These are used for global reach with minimal moderation. Yagub Rahimov, CEO of Polygraf AI, mentioned that such malicious actors have never had such facilities. In his interview with TechNews, he said that communications have shifted from structured dark web forums to fast-moving environments where traditional monitoring breaks down. Telegram and Discord have fundamentally changed in terms of how threat actors communicate. This is creating environments that are fast, semi-anonymous, and optimized for real-time coordination.

Legitimate users have got around keyword filters for Palestine by using the watermelon emoji. This has the same colors as the Palestinian flag. Traditional monitoring systems are based heavily on text matching. But if threats come with augmented keywords using emojis, it can break those models.

Automated systems find it difficult to interpret emojis because the same symbol can carry different meanings depending on context, community, or even the specific threat actor group.