November 4, 2019 By David Bisson 2 min read

A popular Android emoji keyboard is threatening the 40 million users who downloaded the app from the Google Play store with unauthorized purchases of premium digital content.

Upstream detected and blocked more than 14 million suspicious transactions from 110,000 devices that had downloaded the ai.type Android emoji keyboard. Those transaction requests occurred across 13 countries, though they were particularly prevalent in Egypt and Brazil. Had Upstream not blocked them, the requests would have triggered the purchase of premium digital content that could have cost users a combined total of $18 million.

Developed by Israeli firm ai.type LTD, the keyboard disappeared from the Google Play store back in June 2019. However, the app could still be affecting some, if not all, of the 40 million devices that at one point used Google Play to download it. Additionally, the app remains available for download on other Android marketplaces, thereby potentially exposing even more users.

Understanding ai.type in Context

The ai.type keyboard isn’t the only Android keyboard that’s preyed upon users who’ve downloaded it. Back in September 2017, AdGuard observed the popular GO Keyboard secretly collecting the data of its more than 200 million users and then sending this information to third-party trackers and ad networks.

Less than a year later, Symantec observed Android emoji keyboard additions and other capabilities hidden in seven apps that used various techniques to conceal themselves on and deliver ads to infected devices. And in June 2019, Lookout discovered BeiTaAd, adware that came hidden within popular keyboard apps and other Android programs.

Defending Against Malicious Android Emoji Keyboards

Security professionals can help their organizations defend against malicious Android emoji keyboards like ai.type by deploying a unified endpoint management (UEM) solution that uses artificial intelligence to spot anomalous and potentially malicious behavior on all assets, including mobile devices.

Companies should also keep devices current with the latest updates and use security awareness training to educate users about the dangers of downloading apps from unofficial marketplaces.

More from

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

How red teaming helps safeguard the infrastructure behind AI models

4 min read - Artificial intelligence (AI) is now squarely on the frontlines of information security. However, as is often the case when the pace of technological innovation is very rapid, security often ends up being a secondary consideration. This is increasingly evident from the ad-hoc nature of many implementations, where organizations lack a clear strategy for responsible AI use.Attack surfaces aren’t just expanding due to risks and vulnerabilities in AI models themselves but also in the underlying infrastructure that supports them. Many foundation…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today