Security researcher Paul Butler has discovered a way to hide data within an emoji. He was able to encode invisible messages in Unicode emojis by manipulating their variation selectors, which are special characters that modify the appearance of text but don’t visibly affect characters. These selectors can store one byte of data each, and when Butler chained them together he was able to encode a message into an emoji without altering its appearance.
Butler said it is highly unlikely that anyone would be able to use this method to hide malware or malicious code in an emoji. However, since the emoji’s appearance doesn’t change, it could be used as a way to get around human moderators. He suggested that AI could be useful in preventing this, since many of them are programmed to preserve variation selectors. When paired with a code interpreter, they would be able to analyze these selectors in a piece of content and detect any messages hidden in the emojis.
