Android Emoji Keyboard Exposes 40 Million Users to Unauthorized Purchases of Premium Digital Content

A popular Android emoji keyboard is threatening the 40 million users who downloaded the app from the Google Play store with unauthorized purchases of premium digital content.

Upstream detected and blocked more than 14 million suspicious transactions from 110,000 devices that had downloaded the ai.type Android emoji keyboard. Those transaction requests occurred across 13 countries, though they were particularly prevalent in Egypt and Brazil. Had Upstream not blocked them, the requests would have triggered the purchase of premium digital content that could have cost users a combined total of $18 million.

Developed by Israeli firm ai.type LTD, the keyboard disappeared from the Google Play store back in June 2019. However, the app could still be affecting some, if not all, of the 40 million devices that at one point used Google Play to download it. Additionally, the app remains available for download on other Android marketplaces, thereby potentially exposing even more users.

Understanding ai.type in Context

The ai.type keyboard isn’t the only Android keyboard that’s preyed upon users who’ve downloaded it. Back in September 2017, AdGuard observed the popular GO Keyboard secretly collecting the data of its more than 200 million users and then sending this information to third-party trackers and ad networks.

Less than a year later, Symantec observed Android emoji keyboard additions and other capabilities hidden in seven apps that used various techniques to conceal themselves on and deliver ads to infected devices. And in June 2019, Lookout discovered BeiTaAd, adware that came hidden within popular keyboard apps and other Android programs.

Defending Against Malicious Android Emoji Keyboards

Security professionals can help their organizations defend against malicious Android emoji keyboards like ai.type by deploying a unified endpoint management (UEM) solution that uses artificial intelligence to spot anomalous and potentially malicious behavior on all assets, including mobile devices.

Companies should also keep devices current with the latest updates and use security awareness training to educate users about the dangers of downloading apps from unofficial marketplaces.

David Bisson

Contributing Editor

Evolving red teaming for AI environments

2 min read - As AI becomes more ingrained in businesses and daily life, the importance of security grows more paramount. In fact, according to the IBM Institute for Business Value, 96% of executives say adopting generative AI (GenAI) makes a security breach likely in their organization in the next three years. Whether it’s a model performing unintended actions, generating misleading or harmful responses or revealing sensitive information, in the AI era security can no longer be an afterthought to innovation.AI red teaming is emerging…

What we can learn from the best collegiate cyber defenders

3 min read - This year marked the 19th season of the National Collegiate Cyber Defense Competition (NCCDC). For those unfamiliar, CCDC is a competition that puts student teams in charge of managing IT for a fictitious company as the network is undergoing a fundamental transformation. This year the challenge involved a common scenario: a merger. Ten finalist teams were tasked with managing IT infrastructure during this migrational period and, as an added bonus, the networks were simultaneously attacked by a group of red…

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

7 min read - This article was made possible thanks to contributions from Aaron Gdanski.IBM X-Force Incident Response and Threat Intelligence teams have investigated several Akira ransomware attacks since this threat actor group emerged in March 2023. This blog will share X-Force’s unique perspective on Akira gained while observing the threat actors behind this ransomware, including commands used to deploy the ransomware, active exploitation of CVE-2023-20269 and analysis of the ransomware binary.The Akira ransomware group has gained notoriety in the current cybersecurity landscape, underscored…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

Understanding ai.type in Context

Defending Against Malicious Android Emoji Keyboards

More from

Evolving red teaming for AI environments

What we can learn from the best collegiate cyber defenders

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

Topic updates