A popular Android emoji keyboard is threatening the 40 million users who downloaded the app from the Google Play store with unauthorized purchases of premium digital content.
Upstream detected and blocked more than 14 million suspicious transactions from 110,000 devices that had downloaded the ai.type Android emoji keyboard. Those transaction requests occurred across 13 countries, though they were particularly prevalent in Egypt and Brazil. Had Upstream not blocked them, the requests would have triggered the purchase of premium digital content that could have cost users a combined total of $18 million.
Developed by Israeli firm ai.type LTD, the keyboard disappeared from the Google Play store back in June 2019. However, the app could still be affecting some, if not all, of the 40 million devices that at one point used Google Play to download it. Additionally, the app remains available for download on other Android marketplaces, thereby potentially exposing even more users.
Understanding ai.type in Context
The ai.type keyboard isn’t the only Android keyboard that’s preyed upon users who’ve downloaded it. Back in September 2017, AdGuard observed the popular GO Keyboard secretly collecting the data of its more than 200 million users and then sending this information to third-party trackers and ad networks.
Less than a year later, Symantec observed Android emoji keyboard additions and other capabilities hidden in seven apps that used various techniques to conceal themselves on and deliver ads to infected devices. And in June 2019, Lookout discovered BeiTaAd, adware that came hidden within popular keyboard apps and other Android programs.
Defending Against Malicious Android Emoji Keyboards
Security professionals can help their organizations defend against malicious Android emoji keyboards like ai.type by deploying a unified endpoint management (UEM) solution that uses artificial intelligence to spot anomalous and potentially malicious behavior on all assets, including mobile devices.
Companies should also keep devices current with the latest updates and use security awareness training to educate users about the dangers of downloading apps from unofficial marketplaces.