Android Emoji Keyboard Exposes 40 Million Users to Unauthorized Purchases of Premium Digital Content

A popular Android emoji keyboard is threatening the 40 million users who downloaded the app from the Google Play store with unauthorized purchases of premium digital content.

Upstream detected and blocked more than 14 million suspicious transactions from 110,000 devices that had downloaded the ai.type Android emoji keyboard. Those transaction requests occurred across 13 countries, though they were particularly prevalent in Egypt and Brazil. Had Upstream not blocked them, the requests would have triggered the purchase of premium digital content that could have cost users a combined total of $18 million.

Developed by Israeli firm ai.type LTD, the keyboard disappeared from the Google Play store back in June 2019. However, the app could still be affecting some, if not all, of the 40 million devices that at one point used Google Play to download it. Additionally, the app remains available for download on other Android marketplaces, thereby potentially exposing even more users.

Understanding ai.type in Context

The ai.type keyboard isn’t the only Android keyboard that’s preyed upon users who’ve downloaded it. Back in September 2017, AdGuard observed the popular GO Keyboard secretly collecting the data of its more than 200 million users and then sending this information to third-party trackers and ad networks.

Less than a year later, Symantec observed Android emoji keyboard additions and other capabilities hidden in seven apps that used various techniques to conceal themselves on and deliver ads to infected devices. And in June 2019, Lookout discovered BeiTaAd, adware that came hidden within popular keyboard apps and other Android programs.

Defending Against Malicious Android Emoji Keyboards

Security professionals can help their organizations defend against malicious Android emoji keyboards like ai.type by deploying a unified endpoint management (UEM) solution that uses artificial intelligence to spot anomalous and potentially malicious behavior on all assets, including mobile devices.

Companies should also keep devices current with the latest updates and use security awareness training to educate users about the dangers of downloading apps from unofficial marketplaces.

David Bisson

Contributing Editor

NIST’s role in the global tech race against AI

4 min read - Last year, the United States Secretary of Commerce announced that the National Institute of Standards and Technology (NIST) has been put in charge of launching a new public working group on artificial intelligence (AI) that will build on the success of the NIST AI Risk Management Framework to address this rapidly advancing technology.However, recent budget cuts at NIST, along with a lack of strategy implementation, have called into question the agency’s ability to lead this critical effort. Ultimately, the success…

Researchers develop malicious AI ‘worm’ targeting generative AI systems

2 min read - Researchers have created a new, never-seen-before kind of malware they call the "Morris II" worm, which uses popular AI services to spread itself, infect new systems and steal data. The name references the original Morris computer worm that wreaked havoc on the internet in 1988.The worm demonstrates the potential dangers of AI security threats and creates a new urgency around securing AI models.New worm utilizes adversarial self-replicating promptThe researchers from Cornell Tech, the Israel Institute of Technology and Intuit, used what’s…

Passwords, passkeys and familiarity bias

5 min read - As passkey (passwordless authentication) adoption proceeds, misconceptions abound. There appears to be a widespread impression that passkeys may be more convenient and less secure than passwords. The reality is that they are both more secure and more convenient — possibly a first in cybersecurity.Most of us could be forgiven for not realizing passwordless authentication is more secure than passwords. Thinking back to the first couple of use cases I was exposed to — a phone operating system (OS) and a…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

Understanding ai.type in Context

Defending Against Malicious Android Emoji Keyboards

More from

NIST’s role in the global tech race against AI

Researchers develop malicious AI ‘worm’ targeting generative AI systems

Passwords, passkeys and familiarity bias

Topic updates